mediumMultiple ChoiceObjective-mapped

200-901 Practice Question: Refer to the exhibit

Exhibit

apiVersion: v1
kind: Pod
metadata:
  name: webapp
spec:
  containers:
  - name: webapp
    image: myapp:latest
    securityContext:
      runAsUser: 1000
      runAsGroup: 3000
      allowPrivilegeEscalation: false
    volumeMounts:
    - name: config
      mountPath: /etc/config
  volumes:
  - name: config
    configMap:
      name: app-config

Refer to the exhibit. A security audit requires that the container cannot run as root. Which part of the pod spec ensures this?

⚠ Common exam trap

Cisco often tests the distinction between security context fields: candidates confuse `allowPrivilegeEscalation` (which prevents gaining additional privileges after startup) with `runAsUser` (which sets the initial user), leading them to incorrectly select option C when the requirement is to avoid running as root entirely.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

runAsUser: 1000

Setting `runAsUser: 1000` in the pod's security context explicitly instructs the container runtime to launch the container's main process with a user ID of 1000, which is a non-root user. This directly satisfies the security audit requirement that the container cannot run as root (UID 0). The `runAsUser` field overrides the default behavior where containers run as root unless a non-root user is specified in the container image or security context.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The configMap volume
Why it's wrong here
Used for configuration, not security.
✗
The image tag "latest"
Why it's wrong here
Irrelevant to user context.
✗
allowPrivilegeEscalation: false
Why it's wrong here
Prevents gaining more privileges, but does not set the initial user.
✓
runAsUser: 1000
Why this is correct
Sets the container to run as a non-root user.

Go deeper

200-901 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question