KCNA Question 85

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  The Restricted policy in Kubernetes is designed to enforce strict security constraints on containers, but it does allow certain capabilities that are considered safe and necessary for common container operations. Among the capabilities listed, NET_BIND_SERVICE is typically allowed under the Restricted policy because it is often needed for binding to network ports below 1024, which is a common requirement for many applications

• Chose B1

  The Restricted policy in Kubernetes is designed to be very secure, so it only allows a minimal set of capabilities. SYS_CHROOT is considered safe enough because: - It doesn't give elevated privileges - It's often needed for container operations - It can't be easily exploited

• Chose A1

  In Kubernetes, the Restricted policy is a security context that enforces tight constraints on what a container can do. When using the Restricted policy, the capabilities granted to containers are minimal and restricted to those necessary for basic functionality. The CHOWN capability is typically allowed in restricted environments because it is essential for many applications to modify file ownership within the container.