mediumMultiple Select
CKS Practice Question: Which TWO admission plugins are recommended by…
Which TWO admission plugins are recommended by the CIS benchmark to be enabled on the kube-apiserver? (Choose two.)
⚠ Common exam trap
CNCF often tests the misconception that deprecated or removed plugins like PodSecurityPolicy are still recommended, or that blanket deny/admit plugins are viable hardening measures, when in fact the CIS Benchmark focuses on least-privilege and default-secure plugins like NodeRestriction and ServiceAccount.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodeRestriction
The CIS Benchmark for Kubernetes recommends enabling the NodeRestriction and ServiceAccount admission plugins on the kube-apiserver. NodeRestriction limits the Node identity's ability to modify Node and Pod objects, enforcing the principle of least privilege for kubelets. ServiceAccount ensures that every Pod is assigned a default ServiceAccount and that the token is automatically mounted, which is essential for secure pod-to-API-server communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AlwaysDeny
Why it's wrong here
This admission plugin rejects all requests indiscriminately. It would prevent any API operation, including kubelet heartbeats and node updates, effectively bricking the control plane. The CIS benchmark never recommends it because it provides no granularity — it simply denies everything, making the cluster unusable for any workload or management. Instead, the benchmark recommends deny-by-default policies that allow legitimate traffic.
- ✓
NodeRestriction
Why this is correct
This admission plugin restricts the Node authorization mode, limiting kubelet API access to only the node's own identity and specific node-related resources. It ensures that a compromised kubelet cannot modify other nodes or perform broad API actions. CIS specifically recommends enabling NodeRestriction to enforce the principle of least privilege for kubelet credentials, reducing the blast radius of node compromise.
- ✓
ServiceAccount
Why this is correct
This admission plugin governs how service account tokens are automounted into pods. It is enabled by default in Kubernetes, and CIS recommends keeping it enabled because it allows fine-grained control over token mounting (e.g., disabling automount for sensitive workloads). It also validates that service account references exist and are properly formatted, preventing misconfiguration. Disabling it would break default security controls around service account usage.
- ✗
AlwaysAdmit
Why it's wrong here
This plugin bypasses all admission checks, allowing every request to pass through without any validation or mutation. This effectively disables all security policies, including NodeRestriction and ServiceAccount, undermining the cluster's defense-in-depth. CIS explicitly recommends against such a permissive plugin because it opens the cluster to arbitrary code execution and privilege escalation.
- ✗
PodSecurityPolicy
Why it's wrong here
This admission plugin was used to enforce pod security constraints like privileged flags and host namespaces. However, it is deprecated in favor of Pod Security Admission (PSA) and removed in Kubernetes 1.25. CIS no longer recommends it because PSA provides a more maintainable, built-in solution with properly defined policy levels. Using PSP today would require a deprecated and unsupported component, which is a security risk itself.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.