CKAD Practice Question: Application Environment, Configuration and Security
A pod manifest includes the following securityContext: securityContext: { runAsUser: 1000, runAsGroup: 3000, fsGroup: 2000 }. What UID will be used for processes in the container?
⚠ Common exam trap
CNCF often tests the distinction between `runAsUser` (process UID), `runAsGroup` (process GID), and `fsGroup` (volume ownership GID), and the trap here is that candidates confuse `fsGroup` or `runAsGroup` with the process UID, leading them to select 2000 or 3000 instead of 1000.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1000
The `runAsUser` field in the pod's securityContext explicitly sets the user ID (UID) for all processes in the container. In this manifest, `runAsUser: 1000` overrides the default UID (usually 0, root) and ensures that the container's main process runs with UID 1000. The `runAsGroup` and `fsGroup` fields affect group IDs and file ownership, not the process UID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
0 (root)
Why it's wrong here
The value 0 would mean the container's main process runs as the root user (UID 0). However, this pod's securityContext explicitly sets runAsUser: 1000, which overrides any default image user and forces the process to run with UID 1000. Root is not used unless you intentionally set runAsUser: 0, which would be a privilege escalation risk. Therefore, the effective UID is 1000, not 0.
- ✗
3000
Why it's wrong here
The number 3000 corresponds to the runAsGroup field, not the runAsUser field. runAsGroup specifies the primary group ID (GID) for the process, but the user ID (UID) remains exactly what runAsUser defines—1000. So the process's numeric identity is UID=1000, GID=3000, making 3000 an incorrect answer for the UID.
- ✗
2000
Why it's wrong here
The value 2000 is used for the fsGroup field in a pod's securityContext. fsGroup controls the group ownership assigned to mounted volumes and their files, and it does not alter the UID or GID of the main process. The main process still runs with UID 1000 because runAsUser is unchanged; fsGroup only affects volume access permissions. Thus 2000 is not the UID.
- ✓
1000
Why this is correct
runAsUser: 1000 is the correct UID because it directly sets the numeric user ID for the container's primary process. When a container starts, the process is launched with this UID unless an image-level USER directive is overridden by this field. The securityContext's runAsUser takes precedence over the image's default user, so the process runs as UID 1000.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.