Admission Control KCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which kube-apiserver flag is used to enable a specific set of admission controllers?

   • A--admission-control
   • B--disable-admission-plugins
   • C--admission-webhook-config
   • D--enable-admission-plugins
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the security implication of setting `failurePolicy: Ignore` on a validating admission webhook?

   • AIt allows requests to proceed even if the webhook fails, which could weaken security
   • BIt blocks all requests when the webhook is unavailable
   • CIt ensures that the webhook is always called, preventing policy bypass
   • DIt causes the API server to retry the webhook call indefinitely
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A security team has deployed a ValidatingWebhookConfiguration that enforces a critical security policy. The webhook server is running, but the team wants to ensure that if the webhook server crashes, the API server does not allow requests that violate the policy. Which failurePolicy should be configured and what is the trade-off?

   • AIgnore, which is the default and provides high availability.
   • BFail, which is the default and provides high availability.
   • CIgnore, which allows requests to proceed during an outage but risks policy violations.
   • DFail, which blocks requests during an outage but ensures the policy is never bypassed.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which field in a webhook configuration is used to restrict the webhook to only be invoked for resources in specific namespaces?

   • Arules
   • BfailurePolicy
   • CnamespaceSelector
   • DsideEffects
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the Kubernetes API request lifecycle, at what point do admission controllers execute relative to authentication and authorization?

   • AAfter the object is persisted to etcd
   • BBefore authentication and authorization
   • CAfter authentication and authorization, before the request is persisted
   • DOnly for requests from the kubelet
   Reveal Solution Discussion Select an answer first