hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Deploying a containerized application on…
A company is deploying a containerized application on Kubernetes. The security team requires that only signed images from a private registry be used and that containers run without privileged mode. Which Kubernetes admission controller should be configured to enforce both requirements?
⚠ Common exam trap
CompTIA often tests the misconception that ImagePolicyWebhook alone can enforce both image signing and security contexts, but it only handles image validation and has no capability to restrict privileged containers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PodSecurity
PodSecurity is the correct admission controller because it enforces Pod Security Standards (PSS) that can restrict containers from running in privileged mode (via the `privileged` policy) and can be combined with other mechanisms (e.g., image verification) to ensure only signed images are used. While PodSecurity itself does not directly verify image signatures, it can be paired with a separate admission controller like ImagePolicyWebhook or a mutating webhook to enforce signed images, and the question's phrasing implies a single controller that addresses both requirements—PodSecurity is the only option that natively handles the privileged mode restriction and can integrate with signature enforcement. The other options either lack the ability to enforce both conditions or address only one aspect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NodeRestriction
Why it's wrong here
Limits node access to API, not container security.
- ✓
PodSecurity
Why this is correct
PodSecurity (or Pod Security Admission) with a restricted profile disallows privileged containers and can be extended with external webhooks for image signing.
- ✗
ImagePolicyWebhook
Why it's wrong here
Enforces image signatures but not privileged mode restriction.
- ✗
AlwaysPullImages
Why it's wrong here
Pulls images every time but doesn't verify signatures or privilege.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.