CKS Cluster Hardening Practice Question
A security review flags that developers can create pods that mount the host's /etc directory. You need to block hostPath volumes cluster-wide without breaking existing workloads that use the CSI driver for persistent storage. Which control is appropriate?
⚠ Common exam trap
The trap here is reaching for the restricted Pod Security Standard, which does block hostPath but also imposes many other requirements that would break the CSI workloads the scenario says must keep running.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a ValidatingAdmissionPolicy that denies pods whose spec.volumes contain a hostPath entry.
Blocking hostPath volumes requires admission-time inspection of the pod spec. ValidatingAdmissionPolicy lets you express a CEL rule that rejects any pod declaring a hostPath volume, which precisely targets the risk without imposing unrelated restrictions. CSI volumes use a different volume source, so legitimate persistent storage continues to work. PodSecurity restricted, kubelet allow-privileged, and NetworkPolicy all act on different concerns and either over-restrict or miss the mount entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a PodSecurity admission label of restricted to every namespace so hostPath volumes are rejected.
Why it's wrong here
The restricted Pod Security Standard does forbid hostPath volumes, but it also enforces many other constraints such as non-root execution, dropped capabilities, and seccomp profiles. Applying it cluster-wide would break the existing workloads that merely rely on CSI storage, which is exactly what the scenario says must keep working. A narrower control is required.
- ✗
Add a NetworkPolicy with an empty podSelector in each namespace to prevent pods from reading host filesystem paths.
Why it's wrong here
NetworkPolicy governs ingress and egress traffic between pods and external endpoints; it has no visibility into filesystem mounts. A hostPath mount is established by the kubelet at container creation, before any network policy applies. Using NetworkPolicy here would leave the hostPath exposure completely unaddressed while adding unrelated traffic restrictions.
- ✓
Create a ValidatingAdmissionPolicy that denies pods whose spec.volumes contain a hostPath entry.
Why this is correct
A ValidatingAdmissionPolicy with a CEL expression can inspect pod volumes and reject any object containing a hostPath entry, while leaving CSI-backed volumes untouched because those use a csi volume source instead. This gives a cluster-wide, declarative deny rule that does not require a policy controller and aligns with the modern replacement for PodSecurityPolicy-style restrictions.
- ✗
Set --allow-privileged=false on the kubelet of every node so hostPath mounts are refused at runtime.
Why it's wrong here
The allow-privileged flag on kubelet governs whether privileged containers and certain host namespaces are permitted; it does not govern hostPath volume mounts. A pod can still mount /etc via hostPath even when privileged mode is disabled, so this flag fails to address the reported risk and would also block legitimate privileged workloads unrelated to the finding.
Go deeper
Related to this question
Learn chapter
System Hardening: Host OS and Kernel Security
Key term
Admission Controllers
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.