3.3 Given a Use Case, Recommend a Kubernetes Admission Controller Policy Configuration CCCS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the key difference between mutating and validating admission controllers?

   • AValidating controllers are only used for security policies, while mutating controllers are only used for resource optimization.
   • BMutating controllers can modify the request, while validating controllers can only accept or reject it.
   • CValidating controllers can modify the request, while mutating controllers can only accept or reject it.
   • DMutating controllers run after validating controllers to fix any issues found.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team wants to ensure that all pods in their namespace have a specific annotation for compliance tracking. They want the annotation to be added automatically if it is missing, but they do not want the pod to be rejected if the annotation is present. Which Kyverno policy rule should they use?

   • AA mutate rule that adds the annotation if it is missing.
   • BA validate rule that requires the annotation to be present.
   • CA generate rule that creates the annotation on the namespace.
   • DA validate rule with a deny action that blocks pods without the annotation.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the relationship between a Constraint and a ConstraintTemplate in OPA/Gatekeeper?

   • AA Constraint is an instance of a ConstraintTemplate, with specific parameter values.
   • BA ConstraintTemplate is an instance of a Constraint, with specific parameter values.
   • CA Constraint defines the Rego logic, and a ConstraintTemplate applies it to resources.
   • DThey are two independent ways to define policies, with no direct relationship.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is standardizing on a single policy engine for all Kubernetes clusters. They have three requirements: (1) validate that all images come from an approved registry, (2) mutate pods to add a default label, and (3) generate a ConfigMap when a new Namespace is created. Which policy engine should they choose?

   • AOPA Gatekeeper, because it supports validation, mutation, and generation through ConstraintTemplates.
   • BThe built-in PodSecurity admission plugin for validation and Kyverno for mutation and generation.
   • CA combination of Gatekeeper for validation and Kyverno for mutation and generation.
   • DKyverno, because it supports validation, mutation, and generation as native policy capabilities.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A platform team is rolling out a new OPA Gatekeeper policy that will deny any pod that does not have a resource limit set. They have already applied the Constraint with enforcementAction set to 'dryrun' and reviewed the audit results. They now want to enforce the policy, but they are concerned about the impact on a critical application that has a few pods without resource limits. What should they do?

   • AKeep the enforcementAction as 'dryrun' and fix the critical application's pods before switching to 'deny'.
   • BSwitch the enforcementAction to 'deny' and create an exception for the critical application's namespace.
   • CSwitch the enforcementAction to 'deny' and fix the critical application's pods immediately.
   • DDelete the Constraint and recreate it with the default enforcementAction after fixing the critical application's pods.
   Reveal Solution Discussion Select an answer first