1.3 Describe the Purpose and Use Requirements of the Kubernetes Admission Controller CCCS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security administrator wants to use the Falcon admission controller to enforce a policy that requires all images to have a 'prod-approved' label. How does the admission controller enforce this requirement?

   • AIt scans the image in the registry to check for the label
   • BIt mutates the pod spec to add the label if it is missing
   • CIt relies on the container runtime to enforce the label requirement
   • DIt checks the image metadata in the pod spec and rejects the request if the label is missing
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a prerequisite for deploying a Kubernetes admission controller in a cluster?

   • AA separate etcd cluster dedicated to admission control data
   • BA running Kubernetes cluster with the API server configured to enable admission plugins
   • CA dedicated node pool with GPU-enabled instances
   • DA service mesh installed on all worker nodes
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which component is typically required to deploy a custom admission controller (e.g., a validating webhook) in a Kubernetes cluster?

   • AA ValidatingWebhookConfiguration resource that specifies the webhook server endpoint
   • BA NetworkPolicy that allows traffic to the webhook server
   • CA ConfigMap that stores the webhook's TLS certificate
   • DA ServiceAccount with cluster-admin privileges for the webhook pod
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to enforce a policy that blocks any pod using the 'latest' image tag, because it is unpredictable. They have configured this policy in Falcon Cloud Security. How does the admission controller apply this policy to pod creation requests?

   • AIt evaluates the image tag in the pod spec against the policy and rejects the request if it matches the blocked pattern
   • BIt mutates the pod spec to replace 'latest' with a specific version before allowing the request
   • CIt relies on the image pull policy to prevent 'latest' tags from being used
   • DIt scans the image in the registry to determine if the tag is 'latest' and then rejects the request
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A developer is creating a pod using kubectl. The Falcon admission controller is configured to block images with critical vulnerabilities. The developer's image has a critical vulnerability. What does the developer see in the kubectl output?

   • AAn error message indicating that the pod creation was denied by the admission controller
   • BA timeout error because the admission controller is taking too long to respond
   • CA success message indicating that the pod was created, but with a warning
   • DA success message indicating that the pod was created and is now running
   Reveal Solution Discussion Select an answer first