NCP-AIO Administration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploy the NVIDIA GPU Operator with the device plugin and configure a PodSecurityPolicy or OPA Gatekeeper policy that requires pods to request nvidia.com/gpu and forbids privileged mode.

  Why this is correct

  The GPU Operator's device plugin exposes GPUs as schedulable resources (nvidia.com/gpu). Enforcing a policy that requires pods to request this resource ensures that only pods explicitly asking for GPUs receive device nodes. Forbidding privileged mode enforces least privilege. Together, these configurations ensure GPU device nodes are not exposed to pods that do not request them and that pods run with minimal privileges.

• ✗

  Use the NVIDIA GPU Operator with the device plugin and configure pod security contexts to drop all capabilities and add only the NVIDIA_VISIBLE_DEVICES environment variable.

  Why it's wrong here

  Dropping all capabilities is good, but adding only the NVIDIA_VISIBLE_DEVICES environment variable is insufficient for GPU access in Kubernetes. The device plugin must also allocate the GPU resource, and the pod must request nvidia.com/gpu. Without the resource request, the device plugin will not inject the necessary device nodes, so the pod cannot access the GPU even if the environment variable is set.

• ✗

  Install the NVIDIA k8s-device-plugin standalone and set the --pass-device-specs flag to true, then allow all pods to run as root.

  Why it's wrong here

  The --pass-device-specs flag is used to pass device specifications to the container runtime, but it does not enforce least privilege or restrict GPU access to only pods that request it. Allowing all pods to run as root violates the principle of least privilege and could lead to security vulnerabilities. This approach does not meet the security team's requirements.

• ✗

  Enable the NVIDIA device plugin with the --fail-on-init-error=false flag and set privileged: true in the pod security context.

  Why it's wrong here

  Setting privileged: true grants the pod full access to all host devices, including GPU device nodes, violating the principle of least privilege. The --fail-on-init-error flag controls plugin behavior on initialization errors, not security. This combination would expose GPU devices to all pods and grant excessive privileges, contrary to the security requirements.