CAS-004 Security Architecture Practice Question
A security engineer is hardening a Kubernetes environment. Which THREE of the following are effective controls for securing the cluster? (Select THREE.)
⚠ Common exam trap
CAS-005 often tests whether candidates pick generic infrastructure controls (load balancers, antivirus) instead of Kubernetes-native security primitives (PSA, RBAC, Network Policies) that actually address cluster-specific threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enabling Pod Security Admission (PSA) to enforce pod security standards
Option B is correct because Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces the Privileged, Baseline, and Restricted Pod Security Standards at the namespace level, preventing pods from running with dangerous settings like privileged containers or hostPath mounts. Option C is correct because RBAC (Role-Based Access Control) restricts who can perform which verbs on which API resources via Roles/ClusterRoles and RoleBindings/ClusterRoleBindings, directly limiting unauthorized API server access and privilege escalation. Option D is correct because Network Policies are the native Kubernetes mechanism (enforced by a CNI such as Calico or Cilium) to control ingress and egress traffic between pods and namespaces, providing workload segmentation and limiting lateral movement. Option A is not a security control—load balancers configured for high availability address availability and resilience, not confidentiality, integrity, or access control. Option E is not appropriate for Kubernetes hardening: node-level antivirus does not secure the cluster's control plane, API access, or pod-level isolation, and containerized workloads are typically immutable and scanned via image scanning instead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configuring load balancers for high availability
Why it's wrong here
Configuring load balancers for high availability addresses resilience, not security: it distributes traffic across nodes so the cluster survives failures. It fails this scenario because availability engineering does nothing to prevent unauthorised access, privilege escalation or image tampering. It would be the right choice when the requirement is uptime or fault tolerance rather than hardening.
- ✓
Enabling Pod Security Admission (PSA) to enforce pod security standards
Why this is correct
Pod Security Admission enforces the Privileged, Baseline or Restricted pod security standards at namespace level, rejecting pods that request excessive capabilities, host networking or root execution. This satisfies hardening by preventing risky pod specifications from being admitted to the cluster.
- ✓
Implementing RBAC for API server access
Why this is correct
RBAC restricts which users and service accounts may call which API server operations, scoped by Role or ClusterRole bindings. This satisfies cluster hardening by preventing unauthorised creation of workloads, secret reads and privilege escalation through the Kubernetes control plane.
- ✓
Using Network Policies to isolate workloads
Why this is correct
Network Policies act as a pod-level firewall, restricting ingress and egress traffic between workloads by label selectors. This enforces microsegmentation, satisfying the isolation constraint so a compromised pod cannot freely reach other services in the cluster.
- ✗
Installing antivirus on all nodes
Why it's wrong here
Node antivirus targets host malware, not Kubernetes-specific attack surfaces such as API server exposure or RBAC misconfiguration. It is tempting because endpoint protection is standard hardening, but container workloads rarely benefit and it consumes node resources.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.