Automation and Tooling KCSA Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A platform team must enforce a company policy that all Pods in production namespaces run with read-only root filesystems. They want to prevent non-compliant Pods from being created, not just report violations after the fact. Which approach should they use?

   • AConfigure a NetworkPolicy that blocks traffic from Pods with readOnlyRootFilesystem set to false.
   • BUse a mutating admission webhook to add the readOnlyRootFilesystem field to every Pod automatically.
   • CCreate a ValidatingAdmissionPolicy that checks `spec.securityContext.readOnlyRootFilesystem` and denies requests that do not set it to true.
   • DRun a periodic scan with kube-bench and send alerts for any Pods that have readOnlyRootFilesystem set to false.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does policy-as-code enable automated enforcement of security policies in Kubernetes?

   • ABy compiling policies into executable binaries that run on nodes
   • BBy allowing policy engines to evaluate resources against the policies and block non-compliant ones
   • CBy generating human-readable reports that are manually reviewed
   • DBy requiring a human to approve every policy change
   Reveal Solution Discussion Select an answer first
3. 18foundation · easy

   Which Kubernetes API resource is commonly used to enforce policies automatically through admission control?

   • AValidatingAdmissionPolicy
   • BNamespace
   • CConfigMap
   • DService
   Reveal Solution Discussion Select an answer first