CAS-004 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Admission Controller

  Why it's wrong here

  Admission controllers intercept API requests to validate or mutate objects at creation, governing configuration rather than pod-to-pod traffic. They are tempting because they enforce cluster policy, but NetworkPolicy objects select pods by label and define ingress and egress rules controlling which pods may communicate.

• ✗

  PodSecurityPolicy

  Why it's wrong here

  PodSecurityPolicy governs pod specification constraints — privileged mode, host mounts, capabilities — not which pods may reach each other. It is tempting because it hardens workloads, but NetworkPolicy is the resource that selects pods by label and enforces ingress and egress communication rules.

• ✗

  RBAC

  Why it's wrong here

  RBAC governs which users or service accounts may perform API actions, not pod-to-pod traffic; it cannot express Layer 3/4 allow rules between workloads. It is tempting because RBAC is the native Kubernetes authorisation mechanism, and it would be correct for restricting who can create, read or delete cluster resources.

• ✓

  NetworkPolicy

  Why this is correct

  NetworkPolicy objects select pods via label selectors and enforce ingress and egress rules at layer 3/4, restricting traffic to explicitly permitted pod, namespace, or CIDR combinations. This satisfies the stem's requirement for fine-grained pod-to-pod communication control, which Kubernetes denies by default until a policy selects the pod.