CKS Minimize Microservice Vulnerabilities Practice Question
An OPA/Gatekeeper ConstraintTemplate is written to enforce that all Deployments have the label 'app.kubernetes.io/name'. However, the Constraint does not deny Deployments without the label. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Rego rule does not set 'violation' to true when the label is missing
Gatekeeper ConstraintTemplates use Rego to define violation rules. A common mistake is to use 'violation' with a generic message but not actually deny the request. The Rego must contain a 'deny' rule or use the 'violation' keyword correctly. In Gatekeeper, the default Rego rule name is 'violation' and it must be set to true when a violation occurs. If the rule is empty or incorrectly written, it will not deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Rego rule does not set 'violation' to true when the label is missing
Why this is correct
Correct. The ConstraintTemplate must have a Rego rule named 'violation' that evaluates to true when the resource violates the policy.
- ✗
The Constraint is not bound to any namespaces
Why it's wrong here
If the Constraint has no match spec, it applies to all resources; but the rule itself may be ineffective.
- ✗
The Deployment has the label set but with a different value
Why it's wrong here
The policy checks for existence, not value; if the label is missing, the rule should fire.
- ✗
Gatekeeper is not installed in the cluster
Why it's wrong here
If Gatekeeper were not installed, the Constraint would not be processed, but the question implies that the Constraint was applied without effect.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.