Learn. Practice. Feel prepared.
Kubernetes Objective Questions and Answers - Set 3
This Kubernetes Security quiz contains carefully curated objective questions with correct answers and clear explanations. It is designed for DevOps engineers, platform teams, SREs, and cloud security learners to test your skills across cluster hardening, workload security, identity & access, network policies, secrets management, and modern supply chain security best practices. This is part 3 of the series.
Practice Kubernetes MCQs with Detailed Explanations
Answer at least 12 questions to submit and verify answers.
31 Which configuration prevents privilege escalation via Linux capabilities? Medium
Correct answer:
Dropping unnecessary capabilities
Dropping unused Linux capabilities minimizes what a compromised container can do on the host.
32 Which security risk is introduced by using the :latest image tag in production? Medium
Correct answer:
Non-reproducible and unverified deployments
The :latest tag is mutable, leading to non-deterministic builds and potential deployment of unverified images.
33 Which control plane endpoint should be restricted to private networks? High
Correct answer:
API server endpoint
Restricting API server access to private networks reduces exposure to external attacks.
34 Which mechanism prevents pods from accessing the host IPC namespace? High
Correct answer:
hostIPC: false
Disabling hostIPC prevents containers from interacting with host-level inter-process communication resources.
35 Which practice improves detection of compromised workloads? Medium
Correct answer:
Enabling Kubernetes audit logging
Audit logs provide visibility into API actions and help detect suspicious or unauthorized activity.
36 Which security boundary is most commonly bypassed during container escape exploits? High
Correct answer:
Linux kernel isolation
Container escapes often exploit kernel or runtime vulnerabilities to break isolation boundaries.
37 Which configuration limits the set of users a container process can run as? Medium
Correct answer:
runAsUser and runAsGroup
runAsUser and runAsGroup enforce least-privilege execution inside containers.
38 Which Kubernetes feature enforces policy decisions at admission time? Medium
Correct answer:
Admission webhooks
Admission webhooks validate or mutate requests before resources are persisted to etcd.
39 Which practice reduces the attack surface of container images? Medium
Correct answer:
Using minimal base images
Minimal base images reduce the number of binaries and libraries that attackers can exploit.
40 Which security concern is mitigated by enabling node-level firewall rules? High
Correct answer:
Unauthorized control plane access
Node-level firewall rules restrict access to sensitive ports and services, reducing unauthorized access paths.
41 Which setting prevents containers from sharing the host PID namespace? Medium
Correct answer:
hostPID: false
Disabling hostPID ensures pods cannot view or interact with host processes.
42 Which approach best secures inter-service traffic inside the cluster? High
Correct answer:
mTLS between services
Mutual TLS authenticates and encrypts service-to-service communication, preventing spoofing and eavesdropping.
43 Which security measure prevents unauthorized configuration drift? High
Correct answer:
GitOps with policy enforcement
GitOps with enforced policies ensures changes are reviewed, versioned, and validated before being applied.
44 Which feature restricts pods from mounting arbitrary volumes on the host? Medium
Correct answer:
Pod Security Admission policies
Pod Security Admission policies restrict dangerous configurations like hostPath mounts.
45 Which risk is most directly addressed by enabling encryption in transit for etcd communication? High
Correct answer:
Data tampering and eavesdropping
Encrypting etcd traffic in transit prevents attackers from intercepting or modifying sensitive cluster state.