# Runtime & Cluster Security (DevOps)

> Pod Security Standards, Falco, eBPF runtime security, admission controllers (OPA, Kyverno), policy enforcement

- 24 interview questions
- Senior
- [Interview Questions: DevOps](https://sharpskill.dev/en/technologies/devops/interview-questions.md)

## 1. What are the three Pod Security Standards levels defined by Kubernetes?

**Answer**

Kubernetes defines three Pod Security Standards levels: Privileged (no restrictions), Baseline (minimally restrictive, blocks known privilege escalations like hostNetwork or privileged containers), and Restricted (highly restrictive, follows hardening best practices with runAsNonRoot, seccomp, etc.). These levels enable progressive security adoption based on application needs.

## 2. How to apply the Baseline Pod Security Standards level to a namespace with kubectl?

**Answer**

Using pod-security.kubernetes.io labels on the namespace enables Pod Security Standards. There are three modes: enforce (blocks), warn (warns), and audit (logs). The kubectl label command applies these labels with the desired level and version.

## 3. What is the main difference between Baseline and Restricted Pod Security Standards levels?

**Answer**

The Restricted level enforces runAsNonRoot, prohibiting execution as root, while Baseline allows root but blocks privilege escalations. Restricted also adds constraints on capabilities (drop ALL), seccomp (RuntimeDefault), and allowed volumes. It is the recommended level for critical workloads.

## 21 more questions available

- What is the main role of Falco in Kubernetes runtime security?
- What technology enables Falco to monitor system events without modifying the Linux kernel?

Sign up for free: https://sharpskill.dev/en/login

## Other DevOps interview topics

- [Version Control & Git](https://sharpskill.dev/en/technologies/devops/interview-questions/version-control-git.md): 20 questions, Junior
- [Linux Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/linux-fundamentals.md): 22 questions, Junior
- [Shell Scripting & Bash](https://sharpskill.dev/en/technologies/devops/interview-questions/shell-scripting-bash.md): 20 questions, Mid-Level
- [Networking Basics](https://sharpskill.dev/en/technologies/devops/interview-questions/networking-basics.md): 22 questions, Junior
- [Docker Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/docker-fundamentals.md): 24 questions, Junior
- [CI/CD Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/ci-cd-fundamentals.md): 18 questions, Junior
- [GitHub Actions](https://sharpskill.dev/en/technologies/devops/interview-questions/github-actions.md): 22 questions, Mid-Level
- [GitLab CI/CD](https://sharpskill.dev/en/technologies/devops/interview-questions/gitlab-ci.md): 22 questions, Mid-Level
- [Jenkins](https://sharpskill.dev/en/technologies/devops/interview-questions/jenkins.md): 22 questions, Mid-Level
- [Kubernetes Basics](https://sharpskill.dev/en/technologies/devops/interview-questions/kubernetes-basics.md): 26 questions, Mid-Level
- [Kubernetes Networking](https://sharpskill.dev/en/technologies/devops/interview-questions/kubernetes-networking.md): 24 questions, Mid-Level
- [Kubernetes Advanced](https://sharpskill.dev/en/technologies/devops/interview-questions/kubernetes-advanced.md): 24 questions, Mid-Level
- [Ingress & API Gateway](https://sharpskill.dev/en/technologies/devops/interview-questions/ingress-api-gateway.md): 20 questions, Mid-Level
- [Terraform Basics](https://sharpskill.dev/en/technologies/devops/interview-questions/terraform-basics.md): 22 questions, Mid-Level
- [Terraform Advanced](https://sharpskill.dev/en/technologies/devops/interview-questions/terraform-advanced.md): 22 questions, Mid-Level
- [Ansible & Configuration Management](https://sharpskill.dev/en/technologies/devops/interview-questions/ansible-configuration.md): 20 questions, Mid-Level
- [AWS Essentials](https://sharpskill.dev/en/technologies/devops/interview-questions/aws-essentials.md): 26 questions, Mid-Level
- [Azure Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/azure-fundamentals.md): 22 questions, Mid-Level
- [GCP Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/gcp-fundamentals.md): 22 questions, Mid-Level
- [Monitoring & Prometheus](https://sharpskill.dev/en/technologies/devops/interview-questions/monitoring-prometheus.md): 22 questions, Mid-Level
- [Logging & ELK Stack](https://sharpskill.dev/en/technologies/devops/interview-questions/logging-elk.md): 20 questions, Mid-Level
- [Alerting & Incident Response](https://sharpskill.dev/en/technologies/devops/interview-questions/alerting-incident-response.md): 20 questions, Mid-Level
- [Cloud Identity & Secrets](https://sharpskill.dev/en/technologies/devops/interview-questions/cloud-identity-secrets.md): 22 questions, Mid-Level
- [CI/CD Pipeline Security](https://sharpskill.dev/en/technologies/devops/interview-questions/cicd-pipeline-security.md): 20 questions, Mid-Level
- [Helm & Kubernetes](https://sharpskill.dev/en/technologies/devops/interview-questions/helm-kubernetes.md): 20 questions, Mid-Level
- [Container Supply Chain Security](https://sharpskill.dev/en/technologies/devops/interview-questions/container-supply-chain.md): 22 questions, Senior
- [Service Mesh & Istio](https://sharpskill.dev/en/technologies/devops/interview-questions/service-mesh-istio.md): 24 questions, Senior
- [GitOps & ArgoCD](https://sharpskill.dev/en/technologies/devops/interview-questions/gitops-argocd.md): 22 questions, Senior
- [Progressive Delivery](https://sharpskill.dev/en/technologies/devops/interview-questions/progressive-delivery.md): 20 questions, Senior
- [Distributed Observability](https://sharpskill.dev/en/technologies/devops/interview-questions/observability-distributed.md): 22 questions, Senior
- [Disaster Recovery & Backup](https://sharpskill.dev/en/technologies/devops/interview-questions/disaster-recovery.md): 20 questions, Senior
- [Performance Optimization](https://sharpskill.dev/en/technologies/devops/interview-questions/performance-optimization.md): 22 questions, Senior
- [Cloud Cost Optimization](https://sharpskill.dev/en/technologies/devops/interview-questions/infrastructure-cost.md): 20 questions, Senior
- [SRE Principles](https://sharpskill.dev/en/technologies/devops/interview-questions/sre-principles.md): 24 questions, Senior
- [Chaos Engineering](https://sharpskill.dev/en/technologies/devops/interview-questions/chaos-engineering.md): 20 questions, Senior
- [Platform Engineering](https://sharpskill.dev/en/technologies/devops/interview-questions/platform-engineering.md): 22 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/devops/interview-questions/runtime-cluster-security