Questions

1. True or false – containers are "lightweight VMs."

   A. True

   B. False

2. Can a container access resources from its host?

   A. No, it's isolated.

   B. If marked as privileged, yes.

   C. Only if explicitly granted by a policy.

   D. Sometimes.

3. How could an attacker gain access to a cluster through a container?

   A. A bug in the container's application can lead to a remote code execution, which can be used to break out of a vulnerable container and then used to get the kubelet's credentials.

   B. Compromised credentials with the ability to create a container in one namespace can be used to create a container that mounts the node's filesystem to get the kubelet's credentials.

   C. Both of the above.

4. How does the PodSecurityPolicy admission controller determine which policy to apply to a pod?

   A. By reading an annotation on the pod's definition

   B. By comparing the pod's requested capabilities and the policies authorized via the union of the...