# Knowledge Check: Network & Supply Chain Security

---

**1. A NetworkPolicy has `podSelector: {}` with `policyTypes: ["Ingress"]` and no ingress rules
defined. What's the practical effect on every Pod in that namespace?**

*Answer:* Every Pod is selected, and since no ingress rule allows anything, all incoming traffic
to every Pod is denied — this is the "default deny" starting posture, applied namespace-wide.

---

**2. Why is restricting EGRESS (outbound) traffic from a Pod a real security control, not just
a mirror-image nicety of ingress restriction?**

*Answer:* A compromised Pod with unrestricted egress can exfiltrate data to an attacker-controlled
destination or call out to download additional malicious payloads. Restricting egress to only
what's legitimately needed limits what a compromise can accomplish, independent of whether
inbound access was ever an issue.

---

**3. True or false: "default deny, then explicitly allow" and "default allow, then explicitly
block known-bad traffic" provide equivalent security given the same set of rules.**

*Answer:* False. Default-deny blocks anything NOT yet explicitly allowed, including new/
unanticipated attempts. Default-allow only blocks what's already been identified as bad — an
attacker doing something not yet on the block list gets through under the second model but not
the first.

---

**4. Why does minimizing a container image's footprint (fewer packages) improve supply-chain
security specifically, rather than just making the image smaller/faster to pull?**

*Answer:* Fewer installed packages means fewer potential known vulnerabilities (CVEs) present in
the image at all, and a smaller attack surface if the image is ever compromised — it's a
security property, not merely a performance optimization.

## Instructor Notes

**Facilitation:** Question 3 is the core conceptual point of this module — worth confirming it's
genuinely understood, not just correctly guessed.

**Approximate timing:** 5-7 minutes.