CKAD Practice Question: Application Environment, Configuration and Security
A developer wants to ensure that a pod runs with a non-root user and cannot gain root privileges. Which SecurityContext settings should be used?
⚠ Common exam trap
Watch out — candidates often think `runAsNonRoot: true` alone is sufficient to prevent privilege escalation, but it only restricts the initial user ID, not the ability to escalate later, which requires `allowPrivilegeEscalation: false`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
securityContext: runAsNonRoot: true allowPrivilegeEscalation: false
Setting `runAsNonRoot: true` enforces that the container's user ID is non-zero (non-root), and `allowPrivilegeEscalation: false` prevents the container from gaining additional privileges beyond its initial set, such as through setuid binaries or kernel capabilities. Together, they ensure the pod runs as a non-root user and cannot escalate to root, satisfying the developer's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
securityContext: allowPrivilegeEscalation: false
Why it's wrong here
Setting only allowPrivilegeEscalation: false prevents a process from gaining more privileges than its parent, such as through setuid or setgid binaries, but it places no restriction on the container's initial user ID. The container may still run as root (UID 0), directly violating the developer's requirement of running as a non-root user. Thus, this configuration alone cannot ensure a non-root execution environment.
- ✗
securityContext: runAsNonRoot: true
Why it's wrong here
Setting only runAsNonRoot: true verifies and enforces that the container's process runs as a non-root user (UID 0 is rejected), satisfying the explicit non-root requirement. However, it leaves privilege escalation unrestricted; a non-root process could still exploit setuid binaries or other mechanisms to elevate its privileges, potentially to root. Therefore, it does not provide comprehensive security hardening, as it fails to prevent privilege escalation attempts.
- ✓
securityContext: runAsNonRoot: true allowPrivilegeEscalation: false
Why this is correct
Combining runAsNonRoot: true with allowPrivilegeEscalation: false provides defense in depth: the former ensures the container does not start as root, while the latter prevents the process from gaining any additional privileges beyond its current non-root identity, such as via setuid execution or other escalators. This layered approach both satisfies the non-root mandate and blocks a common privilege escalation vector, making it the correct configuration for secure pod deployment.
- ✗
securityContext: runAsNonRoot: true allowPrivilegeEscalation: true
Why it's wrong here
While runAsNonRoot: true correctly rejects running as UID 0, pairing it with allowPrivilegeEscalation: true explicitly permits processes to escalate their privileges after startup, for example through setuid binaries or kernel capabilities. This undermines the purpose of the non-root constraint, because a compromised non-root process could still elevate to root or gain other powerful privileges. Consequently, this configuration is dangerous and effectively defeats the intended security posture.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.