McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 8

Question 70

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.
  2. RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.
  3. Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.
  4. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.

Explanation

Correct Answer

C:

Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. This explains the stated condition. The corresponding action is: Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes. The direct acceptance evidence is: Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. It does not explain the facts described here, which follow from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

B:

This principle describes a separate cause: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The reported condition is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The two mechanisms should not be conflated.

D:

The offered statement is true for this other mechanism: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. It does not explain the facts described here, which follow from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

Question 71

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.
  2. Run kubectl get node worker-c and verify that SchedulingDisabled is absent.
  3. Run kubectl -n observability get role metrics-api-pod-reader -o yaml and confirm only Pod read verbs are present.
  4. Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs.

Explanation

Correct Answer

D:

Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The intended action is: Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes.

Incorrect Answers

A:

This observation would test a different technical dependency: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The current issue is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its decisive check is “Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs”.

B:

The alternative verifies a different condition: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. The current case instead depends on: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Confirm that “Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs”.

C:

That test belongs to another control with this basis: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. In the current case, the governing reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The direct verification is “Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs”.

Question 72

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.
  2. Track temporary maintenance taints in runbooks with explicit removal checkpoints.
  3. Review service-account subjects when workloads or bindings are renamed.
  4. Review workload identity ownership and avoid unnecessary credentials on the default service account.

Explanation

Correct Answer

A:

Use narrowly defined ClusterRoles and periodically audit cluster-wide grants. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes. The relevant mechanism is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

Incorrect Answers

B:

That safeguard is relevant to: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. The current failure instead follows from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its prevention measure is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

C:

This routine guards against another mechanism: A RoleBinding associates the service account subject with a Role inside the binding namespace. The recurring exposure in the current case is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The matching preventive check is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

D:

The suggested review tracks a different technical risk: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. Here the sustained control must address: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Choose “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

Question 73

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The audit group ops-observers must use the existing invoice-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability create rolebinding metrics-api-reader-binding --role=metrics-api-pod-reader --serviceaccount=observability:audit-bot.
  2. Run kubectl auth can-i list pods -n ledger --as=system:serviceaccount:ledger:release-bot and separately test delete deployments with the same impersonation.
  3. Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers.
  4. Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes.

Explanation

Correct Answer

C:

Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Validate the result with: Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A RoleBinding associates the service account subject with a Role inside the binding namespace. The case facts point instead to: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Implement “Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers” to address that specific condition.

B:

This alternative is a response to another technical cause: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The reported case instead depends on: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The action that directly addresses it is “Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers”.

D:

The offered action targets: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The case facts point instead to: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Implement “Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers” to address that specific condition.

Question 74

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The audit group ops-observers must use the existing invoice-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Cordon marks a Node unschedulable to new Pods but does not drain running workloads.
  2. Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.
  3. Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain.
  4. A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

Explanation

Correct Answer

D:

A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. This explains the stated condition. The corresponding action is: Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers. The direct acceptance evidence is: Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context.

Incorrect Answers

A:

This principle describes a separate cause: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. The reported condition is governed by: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The two mechanisms should not be conflated.

B:

Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. That explanation applies to a different technical failure. Here the controlling principle is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

C:

The offered statement is true for this other mechanism: Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain. It does not explain the facts described here, which follow from: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

Question 75

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The audit group ops-observers must use the existing invoice-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context.
  2. Run kubectl -n ledger get deployment invoice-api --show-labels and compare the live labels with the overlay.
  3. Confirm the command passes and use kubectl get crds to verify no unintended CRD was persisted.
  4. Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and expect yes.

Explanation

Correct Answer

A:

Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The intended action is: Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers.

Incorrect Answers

B:

That test belongs to another control with this basis: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. In the current case, the governing reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The direct verification is “Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context”.

C:

This observation would test a different technical dependency: Server-side dry-run evaluates admission and resource schema without persisting the CRD when supported by the relevant admission stack. The current issue is governed by: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Its decisive check is “Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context”.

D:

The alternative verifies a different condition: A RoleBinding associates the service account subject with a Role inside the binding namespace. The current case instead depends on: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Confirm that “Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context”.

Question 76

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The audit group ops-observers must use the existing invoice-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.
  2. Require approval and periodic recertification for ClusterRoleBindings and group membership.
  3. Review workload identity ownership and avoid unnecessary credentials on the default service account.
  4. Track chart provenance, values and release revisions with reviewed deployment change records.

Explanation

Correct Answer

B:

Require approval and periodic recertification for ClusterRoleBindings and group membership. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create clusterrolebinding invoice-api-node-audit --clusterrole=invoice-api-node-reader --group=ops-observers. The relevant mechanism is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

Incorrect Answers

A:

That safeguard is relevant to: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The current failure instead follows from: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Its prevention measure is “Require approval and periodic recertification for ClusterRoleBindings and group membership”.

C:

The suggested review tracks a different technical risk: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. Here the sustained control must address: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Choose “Require approval and periodic recertification for ClusterRoleBindings and group membership”.

D:

That safeguard is relevant to: Helm maintains release revisions and renders templates; an install-or-upgrade path avoids treating an existing release as a new deployment. The current failure instead follows from: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Its prevention measure is “Require approval and periodic recertification for ClusterRoleBindings and group membership”.

Question 77

At Horizon observability, in a disposable simulated environment during a monitored release window: The audit group platform-auditors must use the existing metrics-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl label node worker-b workload=restricted --overwrite.
  2. Run helm rollback metrics-api 3 --namespace observability after verifying release history and any irreversible data migrations.
  3. Run kubectl uncordon worker-b.
  4. Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors.

Explanation

Correct Answer

D:

Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Validate the result with: Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The reported case instead depends on: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The action that directly addresses it is “Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors”.

B:

The proposed action belongs to the mechanism: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. Here the stated fault follows a different mechanism: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The corrective choice is “Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors”.

C:

The offered action targets: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. The case facts point instead to: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Implement “Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors” to address that specific condition.

Question 78

At Horizon observability, in a disposable simulated environment during a monitored release window: The audit group platform-auditors must use the existing metrics-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.
  2. A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject.
  3. Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain.
  4. A consistent etcd snapshot preserves control-plane state; an unauthenticated network copy is not a substitute.

Explanation

Correct Answer

A:

A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. This explains the stated condition. The corresponding action is: Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors. The direct acceptance evidence is: Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context.

Incorrect Answers

B:

The offered statement is true for this other mechanism: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. It does not explain the facts described here, which follow from: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

C:

This principle describes a separate cause: Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain. The reported condition is governed by: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The two mechanisms should not be conflated.

D:

A consistent etcd snapshot preserves control-plane state; an unauthenticated network copy is not a substitute. That explanation applies to a different technical failure. Here the controlling principle is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

Question 79

At Horizon observability, in a disposable simulated environment during a monitored release window: The audit group platform-auditors must use the existing metrics-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get deploy metrics-operator plus kubectl get crd metrics.example.test and inspect Ready and Established conditions.
  2. Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context.
  3. Run sudo etcdutl snapshot status /var/backups/metrics-api.db -w table and confirm a readable snapshot.
  4. Run kubectl -n observability get role metrics-api-pod-reader -o yaml and confirm only Pod read verbs are present.

Explanation

Correct Answer

B:

Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The intended action is: Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors.

Incorrect Answers

A:

That test belongs to another control with this basis: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. In the current case, the governing reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The direct verification is “Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context”.

C:

The alternative verifies a different condition: A consistent etcd snapshot preserves control-plane state; an unauthenticated network copy is not a substitute. The current case instead depends on: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Confirm that “Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context”.

D:

That test belongs to another control with this basis: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. In the current case, the governing reason is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The direct verification is “Run kubectl auth can-i list nodes --as=auditor --as-group=platform-auditors using an authorized impersonation-capable admin context”.

Question 80

At Horizon observability, in a disposable simulated environment during a monitored release window: The audit group platform-auditors must use the existing metrics-api-node-reader ClusterRole for cluster-scoped Node inventory. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Use disruption budgets, replicated workloads and rollback plans before planned node drains.
  2. Document versioned release checkpoints and test rollbacks before production updates.
  3. Require approval and periodic recertification for ClusterRoleBindings and group membership.
  4. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.

Explanation

Correct Answer

C:

Require approval and periodic recertification for ClusterRoleBindings and group membership. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors. The relevant mechanism is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.

Incorrect Answers

A:

This routine guards against another mechanism: Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain. The recurring exposure in the current case is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The matching preventive check is “Require approval and periodic recertification for ClusterRoleBindings and group membership”.

B:

The suggested review tracks a different technical risk: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. Here the sustained control must address: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Choose “Require approval and periodic recertification for ClusterRoleBindings and group membership”.

D:

This routine guards against another mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The recurring exposure in the current case is: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The matching preventive check is “Require approval and periodic recertification for ClusterRoleBindings and group membership”.