Admission Control KCSA Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A cluster has the ResourceQuota admission controller enabled. A namespace has a ResourceQuota that limits total CPU requests to 2 cores. A user tries to create a Pod that requests 3 cores. What happens?

   • AThe Pod is rejected because the request exceeds the namespace's ResourceQuota.
   • BThe Pod is created, but the scheduler will not schedule it until the quota is increased.
   • CThe Pod is created, and the quota is updated to reflect the overage.
   • DThe Pod is created with a reduced CPU request of 2 cores.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A cluster administrator wants to enforce a policy that prevents any Pod from running with the 'latest' image tag. The policy must be applied to all namespaces except 'kube-system'. Which admission control approach is most appropriate?

   • AEnable the PodSecurity admission controller with the 'baseline' policy.
   • BCreate a ResourceQuota in each namespace that limits the number of Pods using the 'latest' tag.
   • CEnable the LimitRanger admission controller and create a LimitRange that restricts image tags.
   • DUse a ValidatingWebhookConfiguration with a namespaceSelector that excludes 'kube-system'.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are configuring a MutatingAdmissionWebhook that adds a default resource request to every Pod. The webhook server is deployed with a self-signed certificate. When you test a Pod creation, the API server returns an error indicating that the webhook connection is not trusted. What is the most likely cause and solution?

   • AThe webhook configuration is missing the clientConfig.caBundle field; add the CA certificate to the webhook configuration.
   • BThe webhook server is using TLS 1.0; upgrade to TLS 1.2 or higher.
   • CThe webhook's CA certificate is not included in the kube-apiserver's --client-ca-file; add the CA to the API server's trust store.
   • DThe webhook's service is not defined in the same namespace as the webhook configuration; move the service to the kube-system namespace.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which built-in admission controller automatically adds a default service account to pods that do not specify one?

   • AServiceAccount
   • BPodSecurity
   • CLimitRanger
   • DNamespaceLifecycle
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Your organization is deploying a policy engine that must inspect every Pod creation request and reject any Pod that requests privileged mode. The policy engine is a separate service that needs to receive the full Pod object before it is persisted to etcd. You have already configured the kube-apiserver to load the policy engine's webhook. Which additional configuration is required to ensure the policy engine sees the request and can reject it?

   • ARegister a ValidatingAdmissionWebhook with a rule matching pods in the create operation and a failurePolicy of Fail.
   • BConfigure the kube-apiserver with --enable-admission-plugins=ValidatingAdmissionWebhook and set the webhook's namespaceSelector to match all namespaces.
   • CEnable the PodSecurity admission controller with the restricted policy and set the namespace label to enforce.
   • DRegister a MutatingAdmissionWebhook with a rule matching pods in the create operation and a failurePolicy of Ignore.
   Reveal Solution Discussion Select an answer first