CAS-004 Security Architecture Practice Question
A security analyst is reviewing a Kubernetes cluster's security configuration. Which component should be used to ensure that only authorized pods can communicate with each other?
⚠ Common exam trap
The trap here is conflating 'pod security' with 'network security' — candidates see 'authorized pods' and reach for PSP or RBAC, but authorization in the network sense means Network Policies, not admission control or API authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Policies
Network Policies in Kubernetes are the native mechanism for controlling pod-to-pod traffic. They use label selectors to define which pods can communicate with which other pods on specified ports and protocols, effectively acting as a firewall at the pod level. Without a Network Policy, all pods in a cluster can communicate freely by default, so applying one is the correct way to restrict east-west traffic to only authorized flows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pod Security Policies (PSP)
Why it's wrong here
Pod Security Policies govern pod admission — privileged mode, host namespaces, volume types — not traffic between running pods, so they cannot restrict pod-to-pod communication. They are tempting because they harden workloads at deployment time; PSP would be the right choice when the requirement is preventing privileged or hostPath-mounted pods from being scheduled at all.
- ✗
Seccomp profiles
Why it's wrong here
Seccomp profiles restrict the system calls a containerised process may invoke, so they harden a pod's kernel attack surface but cannot govern pod-to-pod traffic. They are tempting because they enforce runtime isolation at the syscall layer; they would be the right choice when the requirement is blocking dangerous syscalls such as `ptrace` or `mount` within a container.
- ✓
Network Policies
Why this is correct
Network Policies enforce pod-level ingress and egress rules, restricting traffic to explicitly authorised pod selectors within the cluster. This directly satisfies the requirement that only authorised pods communicate, since default Kubernetes networking permits all pod-to-pod traffic. Unlike service mesh or firewall controls, Network Policies operate at layer 3/4 using label selectors native to the cluster.
- ✗
RBAC roles
Why it's wrong here
RBAC governs which users or service accounts may perform API actions, not pod-to-pod traffic; it cannot authorise or deny connections between workloads. NetworkPolicy objects provide that layer. RBAC is tempting because it is the standard Kubernetes access-control mechanism, and it would be right when restricting who can create, read or delete cluster resources.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.