Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Workload Protection Platform (CWPP)Easy
A security engineer is tasked with deploying Prisma Cloud Defenders to a Kubernetes cluster. The Defenders must be deployed efficiently across all nodes to ensure comprehensive coverage and automatically scale with the cluster. Which Kubernetes object is most suitable for deploying the Prisma Cloud Defender in this scenario?
- ADaemonSet
- BDeployment
- CReplicaSet
- DStatefulSet
Show answer & explanationAnswer & explanation
Correct answer: A. DaemonSet
A DaemonSet ensures that a copy of a Pod (in this case, the Prisma Cloud Defender) runs on every node in the cluster. This is ideal for agents that need to provide host-level security and automatically scales as nodes are added or removed.
Why the other options are wrong
- B. A Deployment manages a set of identical pods, but not necessarily one per node.
- C. A ReplicaSet ensures a specified number of pod replicas are running, not necessarily one per node.
- D. A StatefulSet is for stateful applications requiring stable network identities and persistent storage.
Kubernetes DaemonSet
A Kubernetes object that ensures all (or some) nodes run a copy of a specified Pod.
- Used for host-level services like monitoring agents, log collectors, or security defenders.
- Automatically deploys to new nodes and removes from deleted nodes.
- Guarantees one instance per node (or matched nodes).
Memory trick: DaemonSet: One defender per node, like a guard on every floor.