PCCSE · Question #80
Review this admission control policy: match[{"msg": msg}] { input.request.operation == "CREATE" input.request.kind.kind == "Pod" input.request.resource.resource == "pods" input.request.object.spec.con
The correct answer is B. The policy will block the creation of a privileged pod. The Rego policy evaluates incoming Kubernetes API requests and triggers when all three conditions are true: the operation is 'CREATE', the resource is a 'Pod', and at least one container in the spec has 'privileged: true' in its securityContext. When the policy effect is set to '
Question
Review this admission control policy:
match[{"msg": msg}] { input.request.operation == "CREATE" input.request.kind.kind == "Pod" input.request.resource.resource == "pods" input.request.object.spec.containers[_].securityContext.privileged msg := "Privileged" } Which response to this policy will be achieved when the effect is set to "block"?
Options
- AThe policy will replace Defender with a privileged Defender
- BThe policy will block the creation of a privileged pod
- CThe policy will block all pods on a Privileged host
- DThe policy will alert only the administrator when a privileged pod is created
How the community answered
(28 responses)- A4% (1)
- B93% (26)
- C4% (1)
Explanation
The Rego policy evaluates incoming Kubernetes API requests and triggers when all three conditions are true: the operation is 'CREATE', the resource is a 'Pod', and at least one container in the spec has 'privileged: true' in its securityContext. When the policy effect is set to 'block', Prisma Cloud's admission controller (via OPA) will deny the API server request and prevent the privileged pod from being created. Options A, C, and D are incorrect: the policy doesn't replace Defenders, doesn't target privileged hosts broadly, and 'block' stops the action entirely rather than just alerting.
Topics
Community Discussion
No community discussion yet for this question.