A security team is tasked with ensuring that no Kubernetes workloads in the cluster can run as privileged containers. They decide to use an admission controller policy to enforce this restriction…

Question

Options

• AUse a MutatingWebhookConfiguration to automatically change securityContext.privileged: true to
• BUse a ValidatingWebhookConfiguration to check and deny any pod with
• CUse a Role-Based Access Control (RBAC) rule to prevent users from creating privileged pods
• DUse a NetworkPolicy to block network traffic from privileged pods

• A
  28% (19)
• B
  54% (37)
• C
  6% (4)
• D
  13% (9)

Explanation

Option A: While a MutatingWebhookConfiguration can modify pod specifications, it is not ideal for security enforcement because attackers might still find a way to override or bypass it. A validating webhook provides stricter enforcement. Option B: A ValidatingWebhookConfiguration allows for centralized policy enforcement and can explicitly reject requests that attempt to create privileged containers by checking securityContext.privileged. Option C: RBAC rules control permissions for users and service accounts but do not enforce runtime security settings such as preventing privileged containers. Option D: Network Policies are used to control communication between pods but do not restrict the creation of privileged containers.

No community discussion yet for this question.