A cluster administrator is enforcing the Restricted standard in the 'production' namespace. A developer tries to create a pod with a container that has 'privileged: true' set. What is the outcome?

The pod is created, and the privileged flag is automatically removed.

The pod is created, but only if the developer adds the 'pod-security.kubernetes.io/audit=restricted' label to the pod.

The pod is created, but a warning is logged.

The pod is rejected by the Pod Security Admission controller.

An administrator is troubleshooting why a pod was rejected in a namespace with the label 'pod-security.kubernetes.io/enforce=restricted'. The pod spec includes 'hostNetwork: true'. Which standard does this violate?

None, hostNetwork is always allowed.

How does the Pod Security Admission controller determine which Pod Security Standard to enforce on a given namespace?

By checking the Kubernetes version of the control plane

By inspecting the pod's service account annotations

By querying the API server's audit log for previous pod creations

By reading the namespace's labels that use the prefix pod-security.kubernetes.io

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 3

Pod Security KCSA Practice Questions (Page 2)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 9 practice questions to prepare you well beyond it. (estimate)

9questions here

2free pages

2concepts

22%of the exam

Questions 6–9

6foundation · easy
Which Pod Security Standard is intended for system-level pods that require broad host access, such as those managing networking or storage?
Select an answer first
7application · easy
A cluster administrator is enforcing the Restricted standard in the 'production' namespace. A developer tries to create a pod with a container that has 'privileged: true' set. What is the outcome?
Select an answer first
8application · easy
An administrator is troubleshooting why a pod was rejected in a namespace with the label 'pod-security.kubernetes.io/enforce=restricted'. The pod spec includes 'hostNetwork: true'. Which standard does this violate?
Select an answer first
9foundation · easy
How does the Pod Security Admission controller determine which Pod Security Standard to enforce on a given namespace?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Pod Security KCSA Practice Questions (Page 2)

Questions 6–9

Which Pod Security Standard is intended for system-level pods that require broad host access, such as those managing networking or storage?

A cluster administrator is enforcing the Restricted standard in the 'production' namespace. A developer tries to create a pod with a container that has 'privileged: true' set. What is the outcome?

An administrator is troubleshooting why a pod was rejected in a namespace with the label 'pod-security.kubernetes.io/enforce=restricted'. The pod spec includes 'hostNetwork: true'. Which standard does this violate?

How does the Pod Security Admission controller determine which Pod Security Standard to enforce on a given namespace?

Keep studying — Kubernetes Security Fundamentals