easyMultiple ChoiceObjective-mapped
CKS Practice Question: Which admission plugin is recommended by the CIS…
Which admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes?
⚠ Common exam trap
Test-takers frequently confuse admission plugins that control pod security (like SecurityContextDeny or PodNodeSelector) with the specific plugin that restricts kubelet node modification, leading them to pick a security-focused option that does not address the kubelet's API access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodeRestriction
The NodeRestriction admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes. It limits the kubelet's permissions to only modify its own node and its own pods, preventing it from altering other nodes or performing unauthorized operations. This plugin enforces a security boundary by rejecting requests that attempt to modify node labels, taints, or status outside the kubelet's assigned scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NodeRestriction
Why this is correct
NodeRestriction ensures kubelets can only modify their own node objects.
- ✗
PodNodeSelector
Why it's wrong here
PodNodeSelector is not a standard admission plugin.
- ✗
SecurityContextDeny
Why it's wrong here
This plugin denies pods with certain security contexts, not related to kubelet.
- ✗
AlwaysPullImages
Why it's wrong here
This plugin ensures images are always pulled, not related to kubelet restrictions.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.