1.3 Describe the Purpose and Use Requirements of the Kubernetes Admission Controller CCCS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization wants to deploy the CrowdStrike Falcon admission controller in an existing cluster. The cluster is running Kubernetes v1.28. Which set of prerequisites must be in place before the admission controller can be deployed?

   • AKubernetes version 1.20 or later with the ValidatingAdmissionWebhook and MutatingAdmissionWebhook feature gates enabled
   • BA valid kubeconfig file with cluster-admin privileges and a public internet connection from the cluster
   • CA dedicated node pool with GPU-enabled instances for running the admission controller
   • DA Falcon Customer ID (CID) and a Falcon API client ID/secret with appropriate permissions
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does the CrowdStrike Falcon admission controller enforce security policies on Kubernetes workloads?

   • ABy intercepting pod creation requests and evaluating them against Falcon's security policies before they are admitted
   • BBy monitoring network traffic between pods and reporting anomalies to Falcon Cloud Security
   • CBy scanning container images in the registry after they are pulled by the kubelet
   • DBy periodically auditing running pods and terminating those that violate policies
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of the Kubernetes admission controller?

   • ATo manage network traffic between pods and external services
   • BTo schedule pods onto appropriate worker nodes based on resource requirements
   • CTo intercept and validate API requests before they are persisted to etcd
   • DTo store and retrieve configuration data for the cluster
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement correctly describes the timing of admission controller execution in the Kubernetes API request lifecycle?

   • AIt runs before authentication and authorization are performed
   • BIt runs after the object is persisted to etcd and before the response is returned to the client
   • CIt runs only when a new namespace is created
   • DIt runs after authentication and authorization but before the object is persisted
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is deploying Falcon Cloud Security in a Kubernetes cluster. They need to ensure that no pod is created if its image contains a known critical vulnerability. At which point in the Kubernetes API request lifecycle does the admission controller enforce this check?

   • AAfter the object is persisted to etcd, but before it is returned to the client
   • BBefore the request is authenticated and authorized by the API server
   • CAt the kubelet level, after the pod is scheduled to a node
   • DAfter the request is authenticated and authorized, but before the object is persisted to etcd
   Reveal Solution Discussion Select an answer first