3.3 Given a Use Case, Recommend a Kubernetes Admission Controller Policy Configuration CCCS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In OPA/Gatekeeper, what is the role of a ConstraintTemplate?

   • AIt is a configuration file that defines the OPA server's connection settings.
   • BIt defines the policy logic and the parameters that can be used to instantiate constraints.
   • CIt is a built-in Kubernetes admission controller that enforces pod security standards.
   • DIt is a specific policy instance that is applied to a particular resource or namespace.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A startup is standardizing its Kubernetes deployments. They want to ensure that every new Namespace automatically gets a NetworkPolicy that denies all ingress traffic by default. The platform team prefers a policy engine that can generate resources automatically when a Namespace is created. Which configuration should they use?

   • AUse a ValidatingAdmissionPolicy with a CEL expression that creates a NetworkPolicy for each new Namespace.
   • BDeploy Kyverno and create a ClusterPolicy with a generate rule that creates the default-deny NetworkPolicy when a new Namespace is created.
   • CDeploy OPA Gatekeeper and create a ConstraintTemplate that generates a NetworkPolicy when a Namespace is created.
   • DConfigure the Kubernetes API server with the NamespaceLifecycle admission controller to create default NetworkPolicies.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multi-tenant cluster is shared by several development teams. The security team needs to ensure that no team can deploy a pod with the hostPID or hostIPC namespaces enabled. They want a policy that is easy to update when new teams are added and that can be managed by the cluster administrators only. Which OPA Gatekeeper configuration should they use?

   • AUse a Kyverno ClusterPolicy with a validate rule that denies hostPID and hostIPC, and apply it to all namespaces.
   • BCreate a ConstraintTemplate that checks for hostPID and hostIPC, then create a single Constraint that applies to all namespaces.
   • CCreate a separate ConstraintTemplate for each development team and apply it only to that team's namespace.
   • DConfigure the Kubernetes API server with the PodSecurity admission plugin and set the restricted profile on all namespaces.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of admission controllers in Kubernetes?

   • ATo enforce policies on API requests before the resource is persisted.
   • BTo authenticate users and service accounts making API requests.
   • CTo monitor the health of running containers and restart failed ones.
   • DTo schedule pods onto appropriate nodes based on resource requirements.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the Kubernetes API request lifecycle, at which point do admission controllers enforce policies?

   • AAfter the request is authenticated and authorized, but before the resource is persisted to etcd.
   • BAfter the resource is persisted to etcd, to audit changes that were already applied.
   • CBefore authentication, to ensure only authenticated users can trigger admission control.
   • DDuring the scheduling phase, to decide which node should run the workload.
   Reveal Solution Discussion Select an answer first