Security Policy Language — Kubernetes and Cloud Vocabulary
Learn vocabulary for Kubernetes NetworkPolicy, pod security standards, RBAC policies, least-privilege, deny-by-default, and policy exceptions.
0 / 30 completed
1 / 30
What is a Kubernetes NetworkPolicy in security policy vocabulary?
Kubernetes NetworkPolicy: by default, all pods can communicate with all other pods (allow-all). NetworkPolicy allows you to restrict this: 'only pods with label app=frontend can make egress connections to pods with label app=backend on port 8080.' Requires a CNI plugin that supports NetworkPolicy (Calico, Cilium, Weave). Key vocabulary: podSelector (which pods this policy applies to), ingress rules, egress rules, namespaceSelector, ipBlock.
2 / 30
What are Kubernetes pod security standards (PSS) in policy vocabulary?
Pod Security Standards replaced the deprecated PodSecurityPolicy. Three levels: Privileged (no restrictions — for system workloads), Baseline (prevents known privilege escalations — for most workloads), Restricted (hardened, follows pod hardening best practices — for security-sensitive workloads). Enforced via namespace labels (pod-security.kubernetes.io/enforce: restricted). Key vocabulary: runAsNonRoot, allowPrivilegeEscalation: false, seccompProfile, readOnlyRootFilesystem.
3 / 30
What is 'least-privilege' in RBAC policy vocabulary?
Least-privilege in Kubernetes RBAC vocabulary: 'The payment-service ServiceAccount should have a Role that allows only get and list on Secrets named payment-api-key — not get/list/watch on all Secrets in the namespace.' In practice, over-permissioned service accounts (cluster-admin given to everything) are a common misconfiguration. Tools: kubectl-who-can, rbac-lookup, audit logs. Regular RBAC audits are a compliance requirement.
4 / 30
What is 'deny-by-default' in security policy vocabulary?
Deny-by-default (default-deny / zero-trust posture): start from 'nothing is allowed' and explicitly whitelist what is permitted. Examples: Kubernetes default-deny NetworkPolicy (deny all ingress/egress unless a NetworkPolicy explicitly allows it), OPA policies that default to deny=true and only set deny=false when conditions are met, AWS IAM implicit deny (all actions are denied unless an Allow policy explicitly permits them).
5 / 30
What is a 'policy exception' in security policy vocabulary?
Policy exceptions vocabulary: 'We need to run a legacy container as root (violates pod security restricted profile) until we complete the migration in Q3. Exception approved by security team, tracked in Jira INFRA-4521, expires 2024-09-30.' Exceptions should be: specific (named resource, not 'all services'), time-limited, formally approved, tracked in an exceptions register, and regularly reviewed. Tools like Kyverno support exception resources natively.
6 / 30
Alice: "Hey team, I'm deploying a new microservice using Kubernetes. Should I just grant the service account full access to all AWS S3 buckets for simplicity? It's *really* convenient."
This scenario highlights a common pitfall: prioritizing convenience over security. The 'least-privilege' principle dictates that services should only have the minimum necessary permissions. Granting full S3 access is a significant security risk if compromised, and it's crucial to follow established security policies for cloud deployments.
7 / 30
During a code review of a PR proposing the use of Pod Security Standards (PSS), Ben comments: "This YAML defines constraints on what pods can do. It's essentially a set of predefined security profiles that Kubernetes enforces."
PSS offers a standardized way to manage pod security. It leverages established CIS benchmarks (Common Information Security Benchmark) and other industry best practices to define constraints like restricted capabilities and network access – enabling consistent security across your cluster. PSS is not tied to a specific cloud provider.
8 / 30
You're investigating an incident where unauthorized containers are attempting to access the database. The logs indicate that no NetworkPolicies are defined for this service. What is the most relevant security principle to apply here?
'Deny-by-default' is a core security principle meaning that all connections are initially blocked unless specifically allowed. Without NetworkPolicies to enforce this, your service is vulnerable to unauthorized access attempts. This approach significantly reduces the attack surface by controlling network traffic at the pod level.
9 / 30
Charlie (Lead DevOps Engineer) is explaining a new security policy to the team: "We've implemented a 'policy exception' for our staging environment. This allows specific pods to bypass certain restrictions because it's a non-production environment and we need to test features that would otherwise be blocked."
Policy exceptions are crucial for flexibility while maintaining security. They allow you to test functionality that might otherwise be blocked by default policies in non-production environments. Crucially, exceptions *must* be documented and justified – demonstrating a risk assessment was performed before granting the exception.
10 / 30
You receive an API response from a Kubernetes security auditing tool: `{"status": "error", "message": "Pod 'webserver' is attempting to establish connections outside of its defined network range.", "severity": "critical"}`. What does this primarily indicate?
This API response highlights a critical security issue: the webserver pod isn't adhering to its defined network policy. This could allow unauthorized connections and compromise the application's security. Network policies are designed to control which pods can communicate with each other and external services – this breach needs immediate investigation.
11 / 30
Alice: "Hey team, I'm deploying a new microservice using Kubernetes. Should I just grant the service account full access to all AWS S3 buckets for simplicity? It's *really* convenient."
This scenario highlights a common pitfall: prioritizing convenience over security. The 'least-privilege' principle dictates that services should only have the minimum necessary permissions. Granting full S3 access is a significant security risk if compromised, and it's crucial to follow established security policies for cloud deployments.
12 / 30
During a code review of a PR proposing the use of Pod Security Standards (PSS), Ben comments: "This YAML defines constraints on what pods can do. It's essentially a set of predefined security profiles that Kubernetes enforces."
PSS offers a standardized way to manage pod security. It leverages established CIS benchmarks (Common Information Security Benchmark) and other industry best practices to define constraints like restricted capabilities and network access – enabling consistent security across your cluster. PSS is not tied to a specific cloud provider.
13 / 30
You're investigating an incident where unauthorized containers are attempting to access the database. The logs indicate that no NetworkPolicies are defined for this service. What is the most relevant security principle to apply here?
'Deny-by-default' is a core security principle meaning that all connections are initially blocked unless specifically allowed. Without NetworkPolicies to enforce this, your service is vulnerable to unauthorized access attempts. This approach significantly reduces the attack surface by controlling network traffic at the pod level.
14 / 30
Charlie (Lead DevOps Engineer) is explaining a new security policy to the team: "We've implemented a 'policy exception' for our staging environment. This allows specific pods to bypass certain restrictions because it's a non-production environment and we need to test features that would otherwise be blocked."
Policy exceptions are crucial for flexibility while maintaining security. They allow you to test functionality that might otherwise be blocked by default policies in non-production environments. Crucially, exceptions *must* be documented and justified – demonstrating a risk assessment was performed before granting the exception.
15 / 30
You receive an API response from a Kubernetes security auditing tool: `{"status": "error", "message": "Pod 'webserver' is attempting to establish connections outside of its defined network range.", "severity": "critical"}`. What does this primarily indicate?
This API response highlights a critical security issue: the webserver pod isn't adhering to its defined network policy. This could allow unauthorized connections and compromise the application's security. Network policies are designed to control which pods can communicate with each other and external services – this breach needs immediate investigation.
16 / 30
Alice: "Hey team, I'm deploying a new microservice using Kubernetes. Should I just grant the service account full access to all AWS S3 buckets for simplicity? It's *really* convenient."
This scenario highlights a common pitfall: prioritizing convenience over security. The 'least-privilege' principle dictates that services should only have the minimum necessary permissions. Granting full S3 access is a significant security risk if compromised, and it's crucial to follow established security policies for cloud deployments.
17 / 30
During a code review of a PR proposing the use of Pod Security Standards (PSS), Ben comments: "This YAML defines constraints on what pods can do. It's essentially a set of predefined security profiles that Kubernetes enforces."
PSS offers a standardized way to manage pod security. It leverages established CIS benchmarks (Common Information Security Benchmark) and other industry best practices to define constraints like restricted capabilities and network access – enabling consistent security across your cluster. PSS is not tied to a specific cloud provider.
18 / 30
You're investigating an incident where unauthorized containers are attempting to access the database. The logs indicate that no NetworkPolicies are defined for this service. What is the most relevant security principle to apply here?
'Deny-by-default' is a core security principle meaning that all connections are initially blocked unless specifically allowed. Without NetworkPolicies to enforce this, your service is vulnerable to unauthorized access attempts. This approach significantly reduces the attack surface by controlling network traffic at the pod level.
19 / 30
Charlie (Lead DevOps Engineer) is explaining a new security policy to the team: "We've implemented a 'policy exception' for our staging environment. This allows specific pods to bypass certain restrictions because it's a non-production environment and we need to test features that would otherwise be blocked."
Policy exceptions are crucial for flexibility while maintaining security. They allow you to test functionality that might otherwise be blocked by default policies in non-production environments. Crucially, exceptions *must* be documented and justified – demonstrating a risk assessment was performed before granting the exception.
20 / 30
You receive an API response from a Kubernetes security auditing tool: `{"status": "error", "message": "Pod 'webserver' is attempting to establish connections outside of its defined network range.", "severity": "critical"}`. What does this primarily indicate?
This API response highlights a critical security issue: the webserver pod isn't adhering to its defined network policy. This could allow unauthorized connections and compromise the application's security. Network policies are designed to control which pods can communicate with each other and external services – this breach needs immediate investigation.
21 / 30
Alice: "Hey team, I'm deploying a new microservice using Kubernetes. Should I just grant the service account full access to all AWS S3 buckets for simplicity? It's *really* convenient."
This scenario highlights a common pitfall: prioritizing convenience over security. The 'least-privilege' principle dictates that services should only have the minimum necessary permissions. Granting full S3 access is a significant security risk if compromised, and it's crucial to follow established security policies for cloud deployments.
22 / 30
During a code review of a PR proposing the use of Pod Security Standards (PSS), Ben comments: "This YAML defines constraints on what pods can do. It's essentially a set of predefined security profiles that Kubernetes enforces."
PSS offers a standardized way to manage pod security. It leverages established CIS benchmarks (Common Information Security Benchmark) and other industry best practices to define constraints like restricted capabilities and network access – enabling consistent security across your cluster. PSS is not tied to a specific cloud provider.
23 / 30
You're investigating an incident where unauthorized containers are attempting to access the database. The logs indicate that no NetworkPolicies are defined for this service. What is the most relevant security principle to apply here?
'Deny-by-default' is a core security principle meaning that all connections are initially blocked unless specifically allowed. Without NetworkPolicies to enforce this, your service is vulnerable to unauthorized access attempts. This approach significantly reduces the attack surface by controlling network traffic at the pod level.
24 / 30
Charlie (Lead DevOps Engineer) is explaining a new security policy to the team: "We've implemented a 'policy exception' for our staging environment. This allows specific pods to bypass certain restrictions because it's a non-production environment and we need to test features that would otherwise be blocked."
Policy exceptions are crucial for flexibility while maintaining security. They allow you to test functionality that might otherwise be blocked by default policies in non-production environments. Crucially, exceptions *must* be documented and justified – demonstrating a risk assessment was performed before granting the exception.
25 / 30
You receive an API response from a Kubernetes security auditing tool: `{"status": "error", "message": "Pod 'webserver' is attempting to establish connections outside of its defined network range.", "severity": "critical"}`. What does this primarily indicate?
This API response highlights a critical security issue: the webserver pod isn't adhering to its defined network policy. This could allow unauthorized connections and compromise the application's security. Network policies are designed to control which pods can communicate with each other and external services – this breach needs immediate investigation.
26 / 30
Alice: "Hey team, I'm deploying a new microservice using Kubernetes. Should I just grant the service account full access to all AWS S3 buckets for simplicity? It's *really* convenient."
This scenario highlights a common pitfall: prioritizing convenience over security. The 'least-privilege' principle dictates that services should only have the minimum necessary permissions. Granting full S3 access is a significant security risk if compromised, and it's crucial to follow established security policies for cloud deployments.
27 / 30
During a code review of a PR proposing the use of Pod Security Standards (PSS), Ben comments: "This YAML defines constraints on what pods can do. It's essentially a set of predefined security profiles that Kubernetes enforces."
PSS offers a standardized way to manage pod security. It leverages established CIS benchmarks (Common Information Security Benchmark) and other industry best practices to define constraints like restricted capabilities and network access – enabling consistent security across your cluster. PSS is not tied to a specific cloud provider.
28 / 30
You're investigating an incident where unauthorized containers are attempting to access the database. The logs indicate that no NetworkPolicies are defined for this service. What is the most relevant security principle to apply here?
'Deny-by-default' is a core security principle meaning that all connections are initially blocked unless specifically allowed. Without NetworkPolicies to enforce this, your service is vulnerable to unauthorized access attempts. This approach significantly reduces the attack surface by controlling network traffic at the pod level.
29 / 30
Charlie (Lead DevOps Engineer) is explaining a new security policy to the team: "We've implemented a 'policy exception' for our staging environment. This allows specific pods to bypass certain restrictions because it's a non-production environment and we need to test features that would otherwise be blocked."
Policy exceptions are crucial for flexibility while maintaining security. They allow you to test functionality that might otherwise be blocked by default policies in non-production environments. Crucially, exceptions *must* be documented and justified – demonstrating a risk assessment was performed before granting the exception.
30 / 30
You receive an API response from a Kubernetes security auditing tool: `{"status": "error", "message": "Pod 'webserver' is attempting to establish connections outside of its defined network range.", "severity": "critical"}`. What does this primarily indicate?
This API response highlights a critical security issue: the webserver pod isn't adhering to its defined network policy. This could allow unauthorized connections and compromise the application's security. Network policies are designed to control which pods can communicate with each other and external services – this breach needs immediate investigation.
What will I practice in "Security Policy Language — Kubernetes and Cloud Vocabulary"?
This is a Policy As Code exercise set. It walks through 30 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 30 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.