Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Which Pod Security Standard should most application namespaces enforce?

   1. Aprivileged
   2. Brestricted (or at least baseline)
   3. Cnone
   4. Dadmin
   Show answer

   B. restricted blocks privileged containers, host namespaces and running as root, and requires dropping capabilities and a seccomp profile. baseline is a minimum.

   From lesson 10 · Pod Security & admission control

2. Q2. What does ValidatingAdmissionPolicy (CEL) add compared to webhooks like Kyverno or Gatekeeper?

   1. ANothing
   2. BPolicies evaluated inside the API server itself, with no extra webhook service to run or fail
   3. CImage scanning
   4. DNetwork policy
   Show answer

   B. CEL policies run in-process: no webhook latency or availability risk. Webhook engines add features like mutation, generation and richer libraries.

   From lesson 10 · Pod Security & admission control

3. Q3. Why roll out a new policy in audit/warn mode first?

   1. AIt's faster
   2. BTo discover which existing workloads would break before blocking anything
   3. CEnforce mode is deprecated
   4. DAudit mode is more secure
   Show answer

   B. Enforcing blindly can block deployments or even critical add-ons. Warn/audit shows the impact, so teams can fix manifests first.

   From lesson 10 · Pod Security & admission control

4. Q4. Without encryption at rest, how are Secret values stored in etcd?

   1. AEncrypted with the cluster CA
   2. BBase64-encoded in the object, readable by anyone with etcd access or an etcd backup
   3. CHashed
   4. DNot stored
   Show answer

   B. Secrets are only encoded by default. Encryption at rest protects etcd data and backups; RBAC still controls API access.

   From lesson 11 · Secrets management

5. Q5. Why is a KMS provider better than an aescbc key in the config file?

   1. AIt's faster
   2. BThe key-encryption key lives in an external KMS/HSM, not on the control-plane disk next to the data, and can be rotated and audited there
   3. CIt's the only supported option
   4. DIt removes the need for RBAC
   Show answer

   B. With a local key file, anyone with the control-plane disk has both the data and the key. KMS separates them.

   From lesson 11 · Secrets management

6. Q6. What does the External Secrets Operator do?

   1. AEncrypts etcd
   2. BSyncs secrets from an external store (Vault, AWS Secrets Manager, etc.) into Kubernetes Secrets, and keeps them updated
   3. CReplaces RBAC
   4. DScans images
   Show answer

   B. The source of truth stays in the secret manager; the operator creates or refreshes the in-cluster Secret.

   From lesson 11 · Secrets management

7. Q7. Why deploy images by digest (@sha256:…) rather than by tag?

   1. ADigests are shorter
   2. BA tag can be moved to different content; a digest always refers to exactly the same image bytes
   3. CTags are deprecated
   4. DDigests skip scanning
   Show answer

   B. Tags are mutable pointers. Digests make deployments reproducible, and make signatures meaningful.

   From lesson 12 · Supply chain security

8. Q8. What does an SBOM give you?

   1. AFaster builds
   2. BAn inventory of every package and version inside an image, so you can answer 'are we affected by CVE-X?' quickly
   3. CEncryption
   4. DImage signing
   Show answer

   B. When a new vulnerability is announced, SBOMs let you search what you run instead of rescanning everything blind.

   From lesson 12 · Supply chain security

9. Q9. What does signature verification at admission protect against?

   1. AAll vulnerabilities
   2. BRunning images that weren't built and signed by your trusted pipeline (e.g. pushed by an attacker, or pulled from elsewhere)
   3. CNetwork attacks
   4. DResource exhaustion
   Show answer

   B. Signatures prove origin and integrity. Vulnerability scanning is a separate control, and you need both.

   From lesson 12 · Supply chain security