CKS Supply Chain Security Practice Question
A Kubernetes cluster uses the ImagePolicyWebhook admission controller to enforce image signature verification. The administrator notices that pods are being admitted even when the webhook backend is unreachable. The cluster is configured with defaultAllow: true in the admission configuration. What is the most likely cause of this behavior?
⚠ Common exam trap
The trap here is assuming that a webhook failure always results in denial, but the defaultAllow setting can override that to allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The defaultAllow: true setting in the admission configuration causes the API server to allow pods when the webhook fails to respond.
The defaultAllow field in the ImagePolicyWebhook admission configuration controls whether pods are admitted when the webhook backend is unreachable. When set to true, the API server allows pods on webhook failure, which explains the observed behavior. The other options either do not apply because the webhook is configured and attempted, or they describe different failure modes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The webhook backend is not configured with a valid TLS certificate, causing the API server to skip the webhook.
Why it's wrong here
While TLS certificate issues can cause webhook failures, the API server would typically log errors and, depending on the failure policy, may deny or allow. However, the defaultAllow setting directly controls the behavior when the webhook cannot be reached. If defaultAllow is true, the API server allows the pod even if the webhook call fails, regardless of TLS issues. Thus, TLS misconfiguration is not the root cause here.
- ✓
The defaultAllow: true setting in the admission configuration causes the API server to allow pods when the webhook fails to respond.
Why this is correct
The defaultAllow field in the ImagePolicyWebhook configuration determines the fallback behavior when the webhook backend cannot be reached. When set to true, the API server allows the pod to be admitted if the webhook call fails (e.g., due to network issues or backend downtime). This explains why pods are admitted despite the webhook being unreachable. Setting it to false would deny pods on webhook failure.
- ✗
The ImagePolicyWebhook admission controller is not enabled in the API server's --enable-admission-plugins flag.
Why it's wrong here
If the admission controller were not enabled, no webhook calls would be made, and all pods would be admitted without any image policy checks. However, the scenario states that pods are being admitted when the webhook is unreachable, implying that the webhook is configured and attempted. The defaultAllow setting is the key factor. The controller must be enabled for the webhook to be called, so this is not the cause.
- ✗
The webhook backend is returning an allow response for all requests due to a misconfiguration in its policy logic.
Why it's wrong here
If the webhook backend were returning allow responses, pods would be admitted even when the backend is reachable. However, the scenario specifies that the backend is unreachable. In that case, the webhook cannot return any response, so the behavior is governed by the defaultAllow setting. A misconfiguration in the backend's policy logic would not cause admissions when the backend is down.
Go deeper
Related to this question
Learn chapter
Cluster Hardening: Resource Quotas and Limit Ranges
Key term
Node Restriction
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
Key term
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.