ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Using a validating admission controller to enforce container-image signature verification intercepts every pod creation request and checks that each referenced image has a valid signature from a trusted key before the pod is admitted to the cluster. This stops unsigned or maliciously modified images from ever running. NetworkPolicies only control network traffic and cannot attest to an image's integrity. Encrypting secrets in etcd protects data at rest but does not verify the provenance of container images. A restrictive seccomp profile can limit the system calls a container makes, but it does not prevent a compromised or malicious image from being scheduled in the first place.