Kubernetes and Cloud Native Security Associate (KCSA) free question 4 / 10 · Domain 3: Kubernetes Security Fundamentals
A platform team wants one Pod Security Standards profile for most application namespaces. It should block known privilege escalations, yet still accept a Pod that leaves its security settings at their defaults. Which profile fits?
- Baseline, because it permits the hostPath volumes that most applications need for data.
- Baseline, because it stops known escalations and allows the default Pod configuration.
- Restricted, because it is the one profile that blocks known privilege escalations.
- Privileged, because it is open by design and lets each Pod configuration through.
Show the answer and explanation
Answer: B
Why this is correct
The Pod Security Standards define three cumulative policies that range from highly permissive to highly restrictive. The profile table describes Baseline as a "Minimally restrictive policy which prevents known privilege escalations. Allows the default (minimally specified) Pod configuration." The Baseline section adds that it is aimed at ease of adoption for common containerized workloads and is targeted at application operators and developers of non-critical applications. That matches both requirements of the team: known escalations are blocked, and a Pod that does not set any hardening fields is still accepted. Restricted also blocks known escalations, but the table describes it as a heavily restricted policy following current Pod hardening best practices, which goes beyond what a minimally specified Pod sets.
Why the other options are wrong
"Privileged, because it is open by design and lets each Pod configuration through." … The profile table describes Privileged as an unrestricted policy that "allows for known privilege escalations". It is aimed at system- and infrastructure-level workloads managed by privileged, trusted users, so it fails the first requirement.
"Restricted, because it is the one profile that blocks known privilege escalations." … Baseline is described as the policy "which prevents known privilege escalations", so Restricted is not the only one. Restricted goes further and follows current Pod hardening best practices "at the expense of some compatibility", which works against accepting a default Pod.
"Baseline, because it permits the hostPath volumes that most applications need for data." … The profile is right but the reason is wrong. The Baseline policy specification has a HostPath Volumes control that says "HostPath volumes must be forbidden"; the only allowed value for spec.volumes[].hostPath is undefined/nil.
Three profiles, one direction
Privileged allows known escalations, Baseline prevents them while accepting the default Pod, and Restricted adds current hardening at some cost in compatibility.