Scenario practice questions

Given the exhibit, what will happen when a user creates a pod with an image from an untrusted registry?

Network Topology

Trap 1: The pod is rejected by NodeRestriction admission

NodeRestriction only restricts node kubelet actions.

Trap 2: The pod is rejected by PodSecurity admission

PodSecurity does not validate image registries.

Trap 3: The pod is created but the image is not pulled because it's…

There is no mechanism to block untrusted registries in the given configuration.

A
The pod is rejected by NodeRestriction admission
Why wrong: NodeRestriction only restricts node kubelet actions.
B
The pod is rejected by PodSecurity admission
Why wrong: PodSecurity does not validate image registries.
C
The pod is created and the image is pulled
AlwaysPullImages forces image pull but does not block untrusted registries.
D
The pod is created but the image is not pulled because it's untrusted
Why wrong: There is no mechanism to block untrusted registries in the given configuration.

Question 2mediummultiple choice

You are configuring kubelet to protect kernel defaults. Which flag enables this?

Trap 1: --security-opt=protect-kernel

This is a Docker flag, not kubelet.

Trap 2: --enable-protect-kernel

Not a valid kubelet flag.

Trap 3: --kernel-security

Not a valid kubelet flag.

A
--security-opt=protect-kernel
Why wrong: This is a Docker flag, not kubelet.
B
--protect-kernel-defaults
Correct flag to protect kernel settings.
C
--enable-protect-kernel
Why wrong: Not a valid kubelet flag.
D
--kernel-security
Why wrong: Not a valid kubelet flag.

Question 3mediummultiple choice

A DevOps engineer wants to enforce that all container images running in the cluster are signed using Cosign. Which Kubernetes admission controller is designed for this purpose?

Trap 1: MutatingAdmissionWebhook

MutatingAdmissionWebhook can modify resources but is not specifically for image signing verification.

Trap 2: PodSecurityPolicy (deprecated)

PodSecurityPolicy is deprecated and unrelated to image signing.

Trap 3: ValidatingAdmissionWebhook

While it can be used for custom policies, ImagePolicyWebhook is specifically designed for image policy enforcement.

A
MutatingAdmissionWebhook
Why wrong: MutatingAdmissionWebhook can modify resources but is not specifically for image signing verification.
B
ImagePolicyWebhook
ImagePolicyWebhook is the admission controller that allows integration with external services to verify image signatures.
C
PodSecurityPolicy (deprecated)
Why wrong: PodSecurityPolicy is deprecated and unrelated to image signing.
D
ValidatingAdmissionWebhook
Why wrong: While it can be used for custom policies, ImagePolicyWebhook is specifically designed for image policy enforcement.

Question 4mediummultiple choice

A cluster uses a custom mutating admission webhook that adds a sidecar container to all pods. After an upgrade, the webhook crashes and pods cannot be created. What is the best way to prevent this scenario in future?

Trap 1: Run multiple replicas of the webhook

All replicas could crash simultaneously.

Trap 2: Disable admission webhooks in the cluster

Would break other features.

Trap 3: Create a validating webhook as a backup

Validating webhooks also block if they fail.

A
Run multiple replicas of the webhook
Why wrong: All replicas could crash simultaneously.
B
Set the webhook's failurePolicy to Ignore
Allows pod creation to proceed if webhook is unavailable.
C
Disable admission webhooks in the cluster
Why wrong: Would break other features.
D
Create a validating webhook as a backup
Why wrong: Validating webhooks also block if they fail.

Question 5easymultiple choice

Which admission controller is responsible for validating and modifying images based on an external webhook in Kubernetes?

Trap 1: MutatingAdmissionWebhook

MutatingAdmissionWebhook is for general mutation, not specifically for image policies.

Trap 2: PodSecurity

PodSecurity is a built-in admission controller for Pod Security Standards, not image policies.

Trap 3: ValidatingAdmissionWebhook

ValidatingAdmissionWebhook is for general validation, not specifically for image policies.

A
MutatingAdmissionWebhook
Why wrong: MutatingAdmissionWebhook is for general mutation, not specifically for image policies.
B
ImagePolicyWebhook
ImagePolicyWebhook is specifically designed to enforce image policies.
C
PodSecurity
Why wrong: PodSecurity is a built-in admission controller for Pod Security Standards, not image policies.
D
ValidatingAdmissionWebhook
Why wrong: ValidatingAdmissionWebhook is for general validation, not specifically for image policies.