CKAD Practice Question: Application Environment, Configuration and Security
You want to apply a Pod Security Admission (PSA) policy that enforces the 'restricted' profile in the 'dev' namespace, but only for Pods that are not exempt. Which TWO steps are required? (Select TWO)
⚠ Common exam trap
Many exam-takers confuse the 'warn' mode with 'enforce' mode, as candidates often think a warning label is sufficient to block non-compliant Pods, but only the 'enforce' label actually rejects them at admission time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace
Option A is correct because PSA enforcement is enabled per-namespace by applying the label 'pod-security.kubernetes.io/enforce=restricted' to the 'dev' namespace, which tells the Pod Security Admission controller to reject Pods that violate the restricted profile. Option E is correct because the restricted profile imposes strict requirements — such as runAsNonRoot: true, allowPrivilegeEscalation: false, dropping ALL capabilities, and setting seccompProfile.type to RuntimeDefault or Localhost — so workloads must be configured to satisfy these controls to be admitted. Option B is incorrect because merely setting runAsUser: 1000 does not satisfy the restricted profile, which specifically requires runAsNonRoot rather than a fixed UID. Option C is incorrect because 'baseline' is a less restrictive profile than 'restricted' and would not enforce the required policy. Option D is incorrect because the 'warn' label only produces warnings and does not enforce the restricted profile; enforcement requires the 'enforce' label.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace
Why this is correct
Setting the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace activates the Pod Security Admission controller's restricted policy for all Pods created in that namespace. This label causes the admission controller to reject any Pod that does not meet the restricted profile's requirements, such as running as non-root and using a seccomp profile. It is the standard mechanism for enforcing PSA policies at the namespace level.
- ✗
Add a 'securityContext' field to the Pod template with 'runAsUser: 1000'
Why it's wrong here
Adding a 'securityContext' field with 'runAsUser: 1000' to a Pod template configures that specific Pod to run as user 1000, but it does not enforce any policy across the namespace. PSA enforcement is namespace-level via labels; a per-Pod securityContext is a workload configuration, not an admission control rule. Moreover, setting runAsUser alone is insufficient to satisfy the restricted profile, which also requires runAsNonRoot, dropping all capabilities, and seccomp configuration.
- ✗
Set the label 'pod-security.kubernetes.io/enforce=baseline' on the namespace
Why it's wrong here
Setting 'pod-security.kubernetes.io/enforce=baseline' would apply the baseline profile, which is intentionally less restrictive than restricted. Baseline permits privileged containers and certain capabilities that the restricted profile forbids, such as not requiring seccomp or runAsNonRoot. Since the goal is to apply a restricted PSA policy, this label fails to enforce the intended level of security.
- ✗
Set the label 'pod-security.kubernetes.io/warn=restricted' on the namespace
Why it's wrong here
The label 'pod-security.kubernetes.io/warn=restricted' tells the admission controller to emit a warning for non-compliant Pods but still allows them to be created. Warnings are advisory and do not block admission; only the enforce label rejects. Therefore, this label cannot be used to apply a PSA policy in a mandatory way.
- ✓
Configure Pods to meet the restricted profile requirements, such as setting runAsNonRoot and seccompProfile
Why this is correct
Configuring Pods to meet restricted profile requirements—e.g., setting runAsNonRoot: true and seccompProfile: RuntimeDefault—is the workload-side compliance necessary for the Pods to be accepted when enforcement is active. Even with the enforce=restricted label, any Pod that does not satisfy these and other restrictions will be rejected by the admission controller. This option is correct because it describes the expected Pod configuration alongside the namespace-level enforcement.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.