CKAD Practice Question: Application Environment, Configuration and Security
A container needs to run with the NET_ADMIN capability. Which securityContext field should be used?
⚠ Common exam trap
Many candidates confuse `capabilities.add` with `capabilities.drop` or assume that running as root (`runAsUser: 0`) is the only way to gain network admin privileges, missing the precise capability-based approach that CKAD expects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
capabilities: add: ["NET_ADMIN"]
The `capabilities.add` field in a container's `securityContext` is specifically designed to grant Linux capabilities like `NET_ADMIN` to a container. This allows the container to perform network administration operations (e.g., configuring iptables, changing interface settings) without running as root or giving full privileged access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
capabilities: drop: ["ALL"]
Why it's wrong here
This stanza removes every Linux capability from the container's permitted and effective sets. Because NET_ADMIN is itself a capability, it is also stripped away, so the process cannot perform network administration operations such as changing routes or configuring interfaces, even if it runs as root. Dropping all capabilities is a strong hardening measure, but it explicitly removes the very permission this workload requires.
- ✓
capabilities: add: ["NET_ADMIN"]
Why this is correct
This correctly grants the NET_ADMIN capability, which the kernel checks before allowing network administration operations inside the container's network namespace. The capabilities.add list augments the container's default capability set, permitting actions such as modifying iptables rules, adding or removing routes, and managing interface flags. It supplies the needed privilege with precision, following the least-privilege principle by adding only that specific capability.
- ✗
runAsUser: 0
Why it's wrong here
Setting runAsUser to 0 makes the process run with root's UID, but the kernel decides privileged network operations based on the process's effective capability set, not merely on whether the UID is zero. If NET_ADMIN is not present in the capability sets, a root process is still denied with EPERM when trying to configure network interfaces or routing tables. Root can also drop its own capabilities, so runAsUser: 0 is neither necessary nor sufficient to obtain NET_ADMIN.
- ✗
readOnlyRootFilesystem: true
Why it's wrong here
A read-only root filesystem remounts the container's root filesystem as read-only, preventing writes to files under the root mount and common system paths. It is a filesystem policy and has no effect on the kernel's capability checks; NET_ADMIN governs network namespace operations such as interface configuration and firewall management, not file write permissions. A container could be completely read-only and still need NET_ADMIN, or fully writable and still lack it, so this option cannot satisfy the stated requirement.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.