Learn. Practice. Feel prepared.
Kubernetes Objective Questions and Answers
This Kubernetes Security quiz contains carefully curated objective questions with correct answers and clear explanations. It is designed for DevOps engineers, platform teams, SREs, and cloud security learners to test your skills across cluster hardening, workload security, identity & access, network policies, secrets management, and modern supply chain security best practices.
Practice Kubernetes MCQs with Detailed Explanations
Answer at least 12 questions to submit and verify answers.
1 Which Kubernetes feature enforces fine-grained access control to API resources using roles and bindings? Easy
Correct answer:
RBAC
RBAC allows defining roles with specific permissions and binding them to users, groups, or service accounts to control access to Kubernetes API resources.
2 Which Pod Security Standard replaces PodSecurityPolicy in newer Kubernetes versions? Medium
Correct answer:
Privileged / Baseline / Restricted
Pod Security Admission enforces the Privileged, Baseline, and Restricted profiles at the namespace level.
3 Which component is responsible for authenticating requests to the Kubernetes API server? Medium
Correct answer:
API server authentication modules
The API server handles authentication using configured modules such as certificates, tokens, OIDC, and webhook authentication.
4 What is the primary security risk of running containers with the --privileged flag? Medium
Correct answer:
Container gains near-host-level access
Privileged containers bypass many isolation boundaries and can access host devices and kernel features, significantly increasing the attack surface.
5 Which Kubernetes object is used to limit east-west traffic between pods? Medium
Correct answer:
NetworkPolicy
NetworkPolicy defines allowed ingress and egress traffic between pods and namespaces, enabling zero-trust networking inside the cluster.
6 Which practice best protects secrets at rest in Kubernetes? Medium
Correct answer:
Encrypting etcd with KMS provider
Enabling encryption at rest for etcd using a KMS provider ensures secrets are encrypted before being stored.
7 Which control helps prevent privilege escalation inside a container? Medium
Correct answer:
AllowPrivilegeEscalation=false
Setting allowPrivilegeEscalation to false prevents processes from gaining additional privileges via setuid or similar mechanisms.
8 What is the security benefit of using readOnlyRootFilesystem in a Pod spec? Medium
Correct answer:
Prevents runtime file tampering
A read-only root filesystem reduces the risk of attackers modifying binaries or dropping malicious files at runtime.
9 Which supply chain security measure verifies container image integrity before deployment? Medium
Correct answer:
Image signing and verification
Image signing and verification ensure that only trusted and untampered images are deployed to the cluster.
10 Which Kubernetes feature can block images with critical vulnerabilities from being deployed? Medium
Correct answer:
Admission Controller / Policy Engine
Admission controllers or policy engines can evaluate image metadata and vulnerability scan results to deny non-compliant workloads.
11 Which configuration reduces the blast radius of a compromised pod? Medium
Correct answer:
Least-privilege RBAC and namespaces
Separating workloads by namespace and applying least-privilege RBAC limits the impact of a compromised pod.
12 What is the main risk of mounting the Docker socket into a container? High
Correct answer:
Allows container to control the host
Access to the Docker socket effectively grants root-level control over the host, enabling container escape scenarios.
13 Which runtime security approach detects anomalous behavior inside running containers? Medium
Correct answer:
Runtime behavioral monitoring
Runtime behavioral monitoring detects suspicious activities such as unexpected process execution or network access patterns.
14 Which Kubernetes resource limits resource exhaustion attacks from a noisy neighbor pod? Medium
Correct answer:
Resource requests and limits
Resource requests and limits prevent a single pod from consuming excessive CPU or memory, mitigating denial-of-service risks.
15 Which component should be secured with mutual TLS in a production cluster? High
Correct answer:
kubelet ↔ API server communication
Mutual TLS between kubelet and API server ensures strong authentication and encryption for node-to-control-plane communication.