KCSA Kubernetes Security Fundamentals Practice Question
When configuring a MutatingWebhookConfiguration, you notice that mutating webhooks are executed before validating webhooks. Why is this execution order critical for security and consistency?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It ensures that validating webhooks evaluate the final, mutated state of the object rather than the original input.
Mutating webhooks can alter the object (e.g., injecting sidecars or default security contexts). Validating webhooks must run after mutation so they validate the final, resulting object state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It ensures that validating webhooks evaluate the final, mutated state of the object rather than the original input.
Why this is correct
Validating webhooks need to check the exact object configuration that will be persisted, which includes any changes made by mutating webhooks.
- ✗
It prevents mutating webhooks from timing out while waiting for validation checks.
Why it's wrong here
Timeouts are handled independently by API server timeout configurations for each webhook call.
- ✗
Mutating webhooks require encryption keys generated during the validation phase.
Why it's wrong here
Encryption keys are managed by the API server and KMS/etcd layers, not generated by webhooks.
- ✗
It allows validating webhooks to override any changes made by mutating webhooks if security violations occur.
Why it's wrong here
Validating webhooks can only accept or reject requests; they cannot modify objects.
About these practice questions
Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.