Pod Security KCSA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An administrator is planning to enforce the Restricted standard in a namespace that currently has running workloads. The administrator wants to avoid any disruption to existing workloads while ensuring new pods are compliant. What is the correct sequence of actions?

   • AApply the 'warn' label first, then apply the 'enforce' label.
   • BApply the 'enforce' label immediately and fix any rejected workloads.
   • CApply the 'audit' label first, review the logs, then apply the 'enforce' label.
   • DApply the 'enforce' and 'audit' labels simultaneously.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which Pod Security Standard is the most restrictive and is designed to apply the broadest set of security best practices to pods?

   • AHardened
   • BBaseline
   • CPrivileged
   • DRestricted
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A large organization has multiple teams sharing a cluster. Team A's workloads are compliant with the Restricted standard. Team B has a legacy application that requires a hostPath volume and privileged containers. The security team wants to enforce the strictest policy possible while minimizing operational overhead. What is the best approach?

   • ACreate separate namespaces for each team, enforcing Restricted for Team A and Privileged for Team B.
   • BEnforce Privileged cluster-wide and rely on RBAC to restrict access.
   • CEnforce Restricted in a shared namespace and configure an exemption for Team B's workload.
   • DCreate a single namespace for both teams and enforce Baseline.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security engineer is comparing the Baseline and Restricted Pod Security Standards to decide which to enforce for a new namespace. The namespace will host stateless web applications that only need to listen on port 8080 and write to an emptyDir volume. Which standard is the most appropriate and why?

   • ARestricted, but only if the namespace also gets the 'warn' label to avoid breaking deployments.
   • BBaseline, because it is the default and requires no additional configuration.
   • CBaseline, because Restricted requires dropping all capabilities, which would break the web server.
   • DRestricted, because the workload has no requirements that violate it, and it provides the strongest security posture.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does the 'warn' mode of the Pod Security Admission controller do when a pod violates the configured standard?

   • AIt automatically patches the pod to comply with the standard.
   • BIt rejects the pod creation and returns an error to the user.
   • CIt allows the pod to be created but returns a warning message to the user.
   • DIt records the violation in the audit log but does not notify the user.
   Reveal Solution Discussion Select an answer first