CKAD Practice Question: Application Environment, Configuration and Security
A container image requires running as UID 0 but you need to comply with a 'restricted' Pod Security Admission policy. Which SecurityContext setting allows this while still passing the policy?
⚠ Common exam trap
Many exam-takers assume they can override the restricted policy with a SecurityContext setting like runAsUser: 0, not realizing that the restricted policy explicitly forbids UID 0 and enforces runAsNonRoot: true, making any such override invalid.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No SecurityContext setting allows running as UID 0 under the restricted policy.
The 'restricted' Pod Security Admission policy requires that containers run as non-root (runAsNonRoot: true) and prohibits setting runAsUser to 0. Since the image requires UID 0, no SecurityContext setting can override this policy constraint; the only way to comply is to modify the image to run as a non-root user. Therefore, option B is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set securityContext: { allowPrivilegeEscalation: true }
Why it's wrong here
This flag controls whether a process can gain more privileges than its parent, e.g., via setuid binaries or file capabilities. It does not change the user ID the container runs as, and the restricted Pod Security Standard explicitly requires allowPrivilegeEscalation to be false. Even if set to true, the container would still run as UID 0 if the image specifies it, and the restricted policy's runAsNonRoot: true would still reject the pod. So this option entirely fails to address the UID 0 constraint.
- ✓
No SecurityContext setting allows running as UID 0 under the restricted policy.
Why this is correct
Under the restricted Pod Security Standard, runAsNonRoot must be true, which enforces that the container's primary process runs as a non-root user (UID != 0). There is no securityContext setting that can override this; any attempt to set runAsUser: 0 would be invalidated by admission control. The only solution is to modify the container image to use a non-root user or to run under a different Pod Security Standard. Thus no SecurityContext field permits UID 0.
- ✗
Set securityContext: { runAsNonRoot: true, capabilities: { add: ['SYS_ADMIN'] } }
Why it's wrong here
runAsNonRoot: true requires a non-root UID, so even if you add SYS_ADMIN, the container still cannot run as UID 0. Additionally, the restricted policy forbids adding any capabilities, and SYS_ADMIN is especially dangerous and disallowed. This option combines two violations: it tries to add a forbidden capability while also misapplying runAsNonRoot, which contradicts the goal of running as root. Hence it's doubly wrong.
- ✗
Set runAsUser: 0 and runAsNonRoot: false
Why it's wrong here
Setting runAsUser: 0 explicitly requests UID 0, but the restricted policy mandates runAsNonRoot: true, which rejects any pod that does not meet the non-root requirement. Setting runAsNonRoot: false directly violates the policy's required setting, causing admission to fail. In the restricted Pod Security Standard, you cannot opt out of the non-root requirement; the policy is enforced by the API server regardless of your settings. So this configuration is rejected outright.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.