CCSP Cloud Platform and Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pod Security Admission

  Why it's wrong here

  Pod Security Admission enforces pod-level security standards such as privileged mode and host namespace usage at admission time; it never inspects packet source or destination labels. It is tempting because it hardens workloads, and it would be correct for blocking privileged pods, not for label-based traffic filtering.

• ✓

  Network Policies

  Why this is correct

  Network Policies are Kubernetes objects that select pods by label and define permitted ingress and egress rules, enforced by the CNI plugin. They satisfy the stem's label-based restriction on inter-pod traffic, unlike security groups or firewall rules that operate outside pod identity.

• ✗

  Secrets management with Vault

  Why it's wrong here

  Vault manages secrets, tokens and encryption keys; it does not intercept or filter pod-to-pod packets, so label-based traffic rules cannot be expressed. It is tempting because secrets management is a core cluster hardening control, and it would be correct for injecting credentials, not network policy enforcement.

• ✗

  Role-Based Access Control (RBAC)

  Why it's wrong here

  RBAC governs which users and service accounts may call the Kubernetes API; it authorises control-plane actions, not pod network flows, so label selectors on traffic are outside its scope. It is tempting because RBAC restricts access, and it would be correct for limiting API permissions, not inter-pod communication.