Valid KCSA Dumps shared by ExamDiscuss.com for Helping Passing KCSA Exam! ExamDiscuss.com now offer the newest KCSA exam dumps, the ExamDiscuss.com KCSA exam questions have been updated and answers have been corrected get the newest ExamDiscuss.com KCSA dumps with Test Engine here:
What mechanism can I use to block unsigned images from running in my cluster?
Correct Answer: A
* KubernetesAdmission Controllers(particularlyValidatingAdmissionWebhooks) can be used to enforce policies that validate image signatures. * This is commonly implemented withtools like Sigstore/cosign, Kyverno, or OPA Gatekeeper. * PodSecurityPolicy (PSP):deprecated and never supported image signature validation. * Pod Security Standards (PSS):only apply to pod security fields (privilege, users, host access), not image signatures. * CRI:while runtimes (containerd, CRI-O) may integrate with signature verification tools, enforcement in Kubernetes is generally done viaAdmission Controllersat the API layer. Exact extract (Admission Controllers docs): * "Admission webhooks can be used to enforce custom policies on the objects being admitted." (e.g., validating signatures). References: Kubernetes Docs - Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz /admission-controllers/ Sigstore Project (cosign): https://sigstore.dev/ Kyverno ImageVerify Policy: https://kyverno.io/policies/pod-security/require-image-verification/
