1.3 Describe the Purpose and Use Requirements of the Kubernetes Admission Controller CCCS Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A company runs a multi-tenant Kubernetes cluster where different teams share the same cluster. The security team wants to use the Falcon admission controller to block high-risk images, but only for the 'production' namespace. Other namespaces should not be affected. What is the most efficient way to achieve this?

   • AUse a RoleBinding to grant the admission controller permissions only in the 'production' namespace
   • BDeploy a separate admission controller instance in the 'production' namespace
   • CConfigure the ValidatingWebhookConfiguration with a namespaceSelector that matches only the 'production' namespace
   • DCreate a NetworkPolicy that blocks image pulls in non-production namespaces
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team wants to use the Falcon admission controller to block pods that use images with a known malware signature. How does the admission controller detect this?

   • AIt compares the image hash against a local database of known malware
   • BIt checks the image's digital signature to detect malware
   • CIt queries Falcon Cloud Security, which scans the image and returns a malware detection result
   • DIt runs a malware scanner inside the admission controller pod
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevOps team has deployed the Falcon admission controller in a cluster. They want to ensure that only pods with images that have been scanned and approved by Falcon are allowed to run. What is the primary mechanism the admission controller uses to enforce this policy?

   • AIt relies on the kubelet to reject the pod if the image is not in a local allowlist
   • BIt queries the Falcon Cloud Security API for image vulnerability data and blocks the request if the image is not approved
   • CIt periodically scans all images in the cluster and deletes pods that become vulnerable
   • DIt modifies the pod spec to add a sidecar container that scans the image at runtime
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the role of Falcon Cloud Security's admission controller integration in a Kubernetes cluster?

   • ATo automatically patch vulnerabilities in container images
   • BTo manage Kubernetes RBAC roles and permissions
   • CTo replace the need for runtime threat detection on nodes
   • DTo enforce security policies on workloads at deployment time by validating pod specifications
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer is creating a pod that uses an image with a known high-severity vulnerability. The Falcon admission controller is configured to block such images. What happens when the developer submits the pod creation request?

   • AThe API server creates the pod but marks it as 'quarantined'
   • BThe API server sends the request to the admission controller, which rejects it with a denial message
   • CThe API server creates the pod and sends a warning to the developer
   • DThe API server creates the pod, and the kubelet later terminates it due to the vulnerability
   Reveal Solution Discussion Select an answer first