Security Architecture →mediumMultiple SelectObjective-mapped

CAS-004 Security Architecture Practice Question

An organization is deploying a Kubernetes cluster and needs to harden security. Which THREE controls should be implemented? (Choose three.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Role-Based Access Control (RBAC)

RBAC controls access, network policies segment traffic, and admission controllers enforce policies before pods are created.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Role-Based Access Control (RBAC)
Why this is correct
RBAC restricts user and service account permissions.
✓
Admission controllers
Why this is correct
Admission controllers enforce policies like PodSecurityPolicy.
✗
Seccomp profiles
Why it's wrong here
Seccomp is a container security feature but not a Kubernetes-specific control.
✓
Network policies
Why this is correct
Network policies control pod-to-pod communication.
✗
Service mesh
Why it's wrong here
Service mesh provides observability and traffic management, not a primary hardening control.

Quick reference

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper