CKAD Practice Question: Application Environment, Configuration and Security
A container runs as root (UID 0) but the security policy requires the container to run as non-root user 1000. Which pod security context setting should be added?
⚠ Common exam trap
Watch out — candidates often confuse `runAsNonRoot: true` with setting a specific user ID, not realizing it only enforces non-root but does not guarantee UID 1000, which the question explicitly requires.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
runAsUser: 1000
`runAsUser: 1000` explicitly sets the container's user ID to 1000, ensuring the container process runs as a non-root user. This directly satisfies the security policy requirement to run as UID 1000, overriding the default root (UID 0) behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
runAsNonRoot: true
Why it's wrong here
Setting runAsNonRoot: true merely enforces that the container's user ID cannot be zero (UID 0), but it does not specify which non-root UID the process should adopt. If the container image's default user is an arbitrary non-zero UID such as 1001 or 999, that user will be used, which fails if the security policy demands the exact UID 1000. It prevents root, but does not give the deterministic user mapping required by the policy.
- ✓
runAsUser: 1000
Why this is correct
runAsUser: 1000 directly sets the container process's user ID to 1000, overriding any default user defined in the image's Dockerfile or container runtime configuration. This makes the process run as UID 1000 regardless of the image's original settings, and it is the only way to deterministically satisfy a policy that explicitly requires UID 1000. It is the exact, explicit control needed when the container starts as root by default.
- ✗
fsGroup: 1000
Why it's wrong here
fsGroup is a Pod-level setting that controls the group ID assigned to mounted volumes, giving storage access to that group, but it has no effect on the user ID under which the main container process executes. It only adds supplementary group access to volume mounts, so the process still runs as UID 0 (root) as specified in the image. This option addresses volume permissions, not the container runtime user, and therefore cannot satisfy a policy about user ID.
- ✗
privileged: false
Why it's wrong here
Setting privileged: false prevents the container from gaining all host capabilities and accessing host devices, but it does not modify the user ID of the container's entrypoint process. The container will still run as root if the image's default user is root, because privileged only controls the Linux capabilities granted, not the user identity used by the container runtime. It is a security hardening measure, but it leaves the user ID unchanged, so it cannot meet a policy that requires a specific non-root user such as UID 1000.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.