Learn. Practice. Feel prepared.
Kubernetes Objective Questions and Answers - Set 2
This Kubernetes Security quiz contains carefully curated objective questions with correct answers and clear explanations. It is designed for DevOps engineers, platform teams, SREs, and cloud security learners to test your skills across cluster hardening, workload security, identity & access, network policies, secrets management, and modern supply chain security best practices. This is part 2 of the series.
Practice Kubernetes MCQs with Detailed Explanations
Answer at least 12 questions to submit and verify answers.
16 Which best practice reduces the risk of secret leakage through logs? Medium
Correct answer:
Avoid logging sensitive env vars
Avoid logging sensitive values and environment variables to prevent accidental exposure in logs and monitoring systems.
17 Which Kubernetes feature limits what syscalls a container can invoke? High
Correct answer:
Seccomp profiles
Seccomp profiles restrict the system calls available to a container, reducing kernel attack surface.
18 What is the security benefit of using non-root containers? Medium
Correct answer:
Reduced attack impact if compromised
Running containers as non-root limits the privileges an attacker gains if the container is compromised.
19 Which Kubernetes setting prevents service account tokens from being automatically mounted? High
Correct answer:
automountServiceAccountToken: false
Disabling automatic mounting of service account tokens reduces the risk of token leakage to workloads that do not require API access.
20 Which attack vector is mitigated by restricting hostPath volumes? Medium
Correct answer:
Host filesystem access
Restricting hostPath volumes prevents pods from accessing sensitive files on the host filesystem.
21 Which control enforces container filesystem immutability at runtime? Medium
Correct answer:
readOnlyRootFilesystem
A read-only root filesystem ensures container images remain immutable at runtime, reducing persistence for attackers.
22 Which Kubernetes feature helps isolate workloads at the kernel level? Medium
Correct answer:
Namespaces and cgroups
Linux namespaces and cgroups provide isolation and resource control for containers at the kernel level.
23 Which policy reduces the risk of pulling untrusted images from public registries? High
Correct answer:
Enforce allowed registries and digests
Enforcing allowed registries and immutable digests ensures images come from trusted sources and are not tampered with.
24 Which configuration prevents pods from sharing the host’s network namespace? Medium
Correct answer:
hostNetwork: false
Disabling hostNetwork prevents pods from bypassing cluster networking controls and accessing host network interfaces.
25 Which Kubernetes control plane data store must be protected with strong access controls and encryption? Medium
Correct answer:
etcd
etcd stores cluster state and secrets metadata, making it a high-value target that must be secured.
26 Which feature limits container access to host process IDs? High
Correct answer:
hostPID: false
Disabling hostPID prevents containers from seeing and interacting with host processes.
27 Which security practice hardens nodes against container escape vulnerabilities? Medium
Correct answer:
Regular OS patching and kernel updates
Keeping nodes patched reduces exposure to known kernel and container runtime vulnerabilities.
28 Which mechanism enforces that only signed manifests are applied to the cluster? High
Correct answer:
Manifest signing and verification policies
Manifest signing policies ensure that only trusted and verified configuration changes are applied.
29 Which Kubernetes feature reduces lateral movement by default-denying traffic? Medium
Correct answer:
Default-deny NetworkPolicy
A default-deny NetworkPolicy blocks all traffic unless explicitly allowed, reducing lateral movement.
30 Which approach best secures secrets for workloads needing dynamic credentials? High
Correct answer:
Short-lived credentials with external secret injection
Using short-lived credentials injected at runtime reduces secret exposure and limits blast radius.