Admission Control KCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of the MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controllers?

   • ATo replace the need for authentication and authorization
   • BTo manage the lifecycle of webhook configurations
   • CTo allow external webhook servers to mutate or validate API requests dynamically
   • DTo provide built-in validation for all Kubernetes resources
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the key difference between mutating and validating admission controllers?

   • AMutating controllers only work on pods, while validating controllers work on all resources
   • BValidating controllers run before mutating controllers, and can modify the request object
   • CMutating controllers run before validating controllers, and can modify the request object
   • DValidating controllers are always built-in, while mutating controllers are always external
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A user attempts to create a Pod in a namespace that has a ResourceQuota. The request is denied because the quota would be exceeded. At which point in the API request lifecycle does this rejection occur?

   • ADuring authorization, after the user is authenticated.
   • BDuring admission control, after authentication and authorization.
   • CDuring validation, after the object is persisted to etcd.
   • DDuring authentication, before the request is authorized.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   You have a ValidatingWebhookConfiguration that enforces a security policy. The webhook server is temporarily down for maintenance. You want to ensure that Pod creation is NOT blocked during this maintenance window, but you also want to ensure that the policy is enforced when the webhook is healthy. What failurePolicy should you configure?

   • ANever
   • BIgnore
   • CFail
   • DRetry
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a ValidatingWebhookConfiguration, what is the purpose of the `failurePolicy` field?

   • ATo define the HTTP status code returned when the webhook fails
   • BTo specify how many times the webhook should be retried on failure
   • CTo set the timeout for the webhook call
   • DTo determine whether the API request should be allowed or rejected if the webhook fails
   Reveal Solution Discussion Select an answer first