3.3 Given a Use Case, Recommend a Kubernetes Admission Controller Policy Configuration CCCS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A platform team is enabling admission control for a production cluster. They need to automatically add a nodeSelector to all pods in the 'frontend' namespace to ensure they land on SSD-backed nodes, and they also need to reject any pod that requests host networking. The team wants to implement both behaviors with a single policy engine. Which configuration should they use?

   • AConfigure a ValidatingAdmissionPolicy for hostNetwork and a separate MutatingAdmissionWebhook deployed manually for the nodeSelector.
   • BUse the built-in PodSecurity admission plugin with the restricted profile to block host networking and rely on namespace labels for node selection.
   • CDeploy Kyverno and create a single ClusterPolicy with a mutate rule for the nodeSelector and a validate rule for hostNetwork.
   • DDeploy OPA Gatekeeper with a single ConstraintTemplate that has a mutation rule for nodeSelector and a validation rule for hostNetwork.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a capability of Kyverno policies?

   • ACompiling Rego policies into executable binaries for faster enforcement.
   • BGenerating new Kubernetes resources based on the creation of other resources.
   • CReplacing the Kubernetes scheduler to enforce pod placement policies.
   • DAutomatically rolling back deployments that violate policies.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which admission policy use case is specifically designed to prevent containers from running with elevated privileges on the host?

   • AValidating image registries.
   • BRestricting privileged containers.
   • CSetting pod anti-affinity rules.
   • DEnforcing resource quotas.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of dry-run mode when testing admission policies?

   • ATo apply the policy to a separate test cluster automatically.
   • BTo generate a report of all policy violations in the cluster.
   • CTo permanently delete all resources that violate the policy.
   • DTo evaluate the policy's effect on requests without actually blocking or mutating them.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the Kubernetes admission controller execution order, which type of admission controller runs first?

   • ABoth run simultaneously to reduce latency.
   • BMutating admission controllers, because they can modify the request before validation.
   • CValidating admission controllers, because they ensure the request is correct before any changes.
   • DThe order is random and determined by the API server at runtime.
   Reveal Solution Discussion Select an answer first