McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 10

Question 90

At Horizon observability, in a disposable simulated environment during a monitored release window: Before promoting metrics-api, verify service account audit-bot in observability can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there.
  2. Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction.
  3. Custom resources are reconciled only when their schemas are registered and the operator controller is healthy.
  4. RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

Explanation

Correct Answer

D:

RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. This explains the stated condition. The corresponding action is: Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and separately test delete deployments with the same impersonation. The direct acceptance evidence is: Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.

Incorrect Answers

A:

Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. That explanation applies to a different technical failure. Here the controlling principle is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

B:

The offered statement is true for this other mechanism: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. It does not explain the facts described here, which follow from: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

C:

This principle describes a separate cause: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. The reported condition is governed by: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The two mechanisms should not be conflated.

Question 91

At Horizon observability, in a disposable simulated environment during a monitored release window: Before promoting metrics-api, verify service account audit-bot in observability can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.
  2. Run kubectl -n fulfillment get serviceaccount sync-bot and inspect the Deployment's serviceAccountName after binding it.
  3. Run kubectl -n ledger get role invoice-api-pod-reader -o yaml and confirm only Pod read verbs are present.
  4. Run kubectl -n observability get role metrics-api-pod-reader -o yaml and confirm only Pod read verbs are present.

Explanation

Correct Answer

A:

Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The intended action is: Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and separately test delete deployments with the same impersonation.

Incorrect Answers

B:

This observation would test a different technical dependency: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. The current issue is governed by: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Its decisive check is “Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy”.

C:

The alternative verifies a different condition: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The current case instead depends on: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Confirm that “Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy”.

D:

That test belongs to another control with this basis: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. In the current case, the governing reason is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The direct verification is “Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy”.

Question 92

At Horizon observability, in a disposable simulated environment during a monitored release window: Before promoting metrics-api, verify service account audit-bot in observability can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review service-account subjects when workloads or bindings are renamed.
  2. Add explicit allowed-and-denied authorization tests after RBAC changes.
  3. Keep namespace-scoped read policies in version control and avoid wildcard verbs or resources.
  4. Monitor operator controller availability and CRD conversion compatibility across upgrades.

Explanation

Correct Answer

B:

Add explicit allowed-and-denied authorization tests after RBAC changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and separately test delete deployments with the same impersonation. The relevant mechanism is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

Incorrect Answers

A:

This routine guards against another mechanism: A RoleBinding associates the service account subject with a Role inside the binding namespace. The recurring exposure in the current case is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The matching preventive check is “Add explicit allowed-and-denied authorization tests after RBAC changes”.

C:

That safeguard is relevant to: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The current failure instead follows from: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Its prevention measure is “Add explicit allowed-and-denied authorization tests after RBAC changes”.

D:

This routine guards against another mechanism: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. The recurring exposure in the current case is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The matching preventive check is “Add explicit allowed-and-denied authorization tests after RBAC changes”.

Question 93

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Before promoting dispatch-api, verify service account sync-bot in fulfillment can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl cordon worker-c.
  2. Run helm upgrade --install dispatch-api ./charts/dispatch-api --namespace fulfillment --create-namespace --set replicaCount=5 after inspecting values.
  3. Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes.
  4. Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation.

Explanation

Correct Answer

D:

Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation. This is the appropriate command-line action or first safe diagnostic. The technical reason is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Validate the result with: Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. Here the stated fault follows a different mechanism: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The corrective choice is “Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation”.

B:

The offered action targets: Helm maintains release revisions and renders templates; an install-or-upgrade path avoids treating an existing release as a new deployment. The case facts point instead to: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Implement “Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation” to address that specific condition.

C:

This alternative is a response to another technical cause: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The reported case instead depends on: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The action that directly addresses it is “Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation”.

Question 94

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Before promoting dispatch-api, verify service account sync-bot in fulfillment can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.
  2. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.
  3. A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.
  4. Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation.

Explanation

Correct Answer

A:

RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. This explains the stated condition. The corresponding action is: Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation. The direct acceptance evidence is: Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.

Incorrect Answers

B:

This principle describes a separate cause: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. The reported condition is governed by: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The two mechanisms should not be conflated.

C:

A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. That explanation applies to a different technical failure. Here the controlling principle is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

D:

The offered statement is true for this other mechanism: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. It does not explain the facts described here, which follow from: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

Question 95

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Before promoting dispatch-api, verify service account sync-bot in fulfillment can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs.
  2. Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.
  3. Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist.
  4. Run kubectl describe node worker-c and inspect the Taints field for the intended key, value and effect.

Explanation

Correct Answer

B:

Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The intended action is: Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation.

Incorrect Answers

A:

This observation would test a different technical dependency: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The current issue is governed by: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Its decisive check is “Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy”.

C:

That test belongs to another control with this basis: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. In the current case, the governing reason is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The direct verification is “Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy”.

D:

This observation would test a different technical dependency: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. The current issue is governed by: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Its decisive check is “Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy”.

Question 96

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Before promoting dispatch-api, verify service account sync-bot in fulfillment can list Pods but cannot delete Deployments. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Monitor operator controller availability and CRD conversion compatibility across upgrades.
  2. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.
  3. Add explicit allowed-and-denied authorization tests after RBAC changes.
  4. Record node maintenance ownership and uncordon obligations before opening a window.

Explanation

Correct Answer

C:

Add explicit allowed-and-denied authorization tests after RBAC changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation. The relevant mechanism is: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

Incorrect Answers

A:

The suggested review tracks a different technical risk: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. Here the sustained control must address: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Choose “Add explicit allowed-and-denied authorization tests after RBAC changes”.

B:

That safeguard is relevant to: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The current failure instead follows from: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Its prevention measure is “Add explicit allowed-and-denied authorization tests after RBAC changes”.

D:

The suggested review tracks a different technical risk: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. Here the sustained control must address: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Choose “Add explicit allowed-and-denied authorization tests after RBAC changes”.

Question 97

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The worker worker-a needs the scheduling label workload=restricted used by an approved nodeSelector. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl label node worker-a workload=restricted --overwrite.
  2. Run kubectl -n fulfillment create serviceaccount sync-bot and set the workload to use that service account separately.
  3. Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite.
  4. Run kubectl uncordon worker-c.

Explanation

Correct Answer

A:

Run kubectl label node worker-a workload=restricted --overwrite. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Validate the result with: Run kubectl get node worker-a --show-labels and inspect workloads' node selectors. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

This alternative is a response to another technical cause: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. The reported case instead depends on: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The action that directly addresses it is “Run kubectl label node worker-a workload=restricted --overwrite”.

C:

The proposed action belongs to the mechanism: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Here the stated fault follows a different mechanism: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The corrective choice is “Run kubectl label node worker-a workload=restricted --overwrite”.

D:

The offered action targets: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. The case facts point instead to: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Implement “Run kubectl label node worker-a workload=restricted --overwrite” to address that specific condition.

Question 98

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The worker worker-a needs the scheduling label workload=restricted used by an approved nodeSelector. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there.
  2. Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction.
  3. Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.
  4. Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain.

Explanation

Correct Answer

B:

Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. This explains the stated condition. The corresponding action is: Run kubectl label node worker-a workload=restricted --overwrite. The direct acceptance evidence is: Run kubectl get node worker-a --show-labels and inspect workloads' node selectors.

Incorrect Answers

A:

This principle describes a separate cause: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. The reported condition is governed by: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The two mechanisms should not be conflated.

C:

The offered statement is true for this other mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. It does not explain the facts described here, which follow from: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction.

D:

This principle describes a separate cause: Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain. The reported condition is governed by: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The two mechanisms should not be conflated.

Question 99

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The worker worker-a needs the scheduling label workload=restricted used by an approved nodeSelector. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.
  2. Run kubectl describe node worker-a and confirm the specific taint is absent.
  3. Run kubectl get node worker-a --show-labels and inspect workloads' node selectors.
  4. Run kubectl -n fulfillment get serviceaccount sync-bot and inspect the Deployment's serviceAccountName after binding it.

Explanation

Correct Answer

C:

Run kubectl get node worker-a --show-labels and inspect workloads' node selectors. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The intended action is: Run kubectl label node worker-a workload=restricted --overwrite.

Incorrect Answers

A:

The alternative verifies a different condition: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The current case instead depends on: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Confirm that “Run kubectl get node worker-a --show-labels and inspect workloads' node selectors”.

B:

That test belongs to another control with this basis: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. In the current case, the governing reason is: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The direct verification is “Run kubectl get node worker-a --show-labels and inspect workloads' node selectors”.

D:

The alternative verifies a different condition: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. The current case instead depends on: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Confirm that “Run kubectl get node worker-a --show-labels and inspect workloads' node selectors”.

Question 100

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The worker worker-a needs the scheduling label workload=restricted used by an approved nodeSelector. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Include schedulability restoration in maintenance completion checklists.
  2. Record node maintenance ownership and uncordon obligations before opening a window.
  3. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.
  4. Reserve and govern security-sensitive scheduling labels through controlled change procedures.

Explanation

Correct Answer

D:

Reserve and govern security-sensitive scheduling labels through controlled change procedures. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl label node worker-a workload=restricted --overwrite. The relevant mechanism is: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction.

Incorrect Answers

A:

That safeguard is relevant to: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. The current failure instead follows from: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Its prevention measure is “Reserve and govern security-sensitive scheduling labels through controlled change procedures”.

B:

This routine guards against another mechanism: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. The recurring exposure in the current case is: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The matching preventive check is “Reserve and govern security-sensitive scheduling labels through controlled change procedures”.

C:

The suggested review tracks a different technical risk: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Here the sustained control must address: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Choose “Reserve and govern security-sensitive scheduling labels through controlled change procedures”.