CKAD Practice Question: Application Environment, Configuration and Security
A pod needs to run as a non-root user with UID 1000. Which SecurityContext field should be set?
⚠ Common exam trap
Many candidates confuse `runAsUser` with `runAsGroup` or `fsGroup`, thinking group or filesystem settings control the process user identity, when only `runAsUser` directly sets the UID of the running process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
runAsUser: 1000
The `runAsUser` field in the PodSecurityContext or container SecurityContext sets the user ID (UID) under which the container's main process runs. Setting `runAsUser: 1000` ensures the container runs as a non-root user with UID 1000, meeting the requirement. This field directly controls the effective UID of the process, overriding the default root (UID 0).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
runAsUser: 1000
Why this is correct
Setting runAsUser: 1000 in the pod's securityContext instructs the container runtime to launch the main process with UID 1000, which satisfies the requirement of running as a non-root user with that exact user ID. This overrides the default user defined in the image, ensuring all processes inside the container operate as UID 1000 rather than root, which is precisely what the statement demands.
- ✗
runAsGroup: 1000
Why it's wrong here
Setting `runAsGroup: 1000` only specifies the primary group ID for the container’s processes, not the user ID; the pod would still run as root unless `runAsUser` is also set. This option is tempting because `runAsGroup` is commonly used alongside `runAsUser` to enforce group-level permissions, and it would be correct if the requirement were to run the container with a specific group ID rather than a specific non-root user.
- ✗
runAsNonRoot: true
Why it's wrong here
The runAsNonRoot: true setting only instructs Kubernetes to verify that the container image does not run as root; it does not specify which UID to use. A container could run as UID 1234 or any other non-zero UID and still pass this check, so it fails to guarantee that the process runs with UID 1000 specifically. Additionally, if the image's default user is root, this directive will cause the pod to fail creation rather than magically reassign the UID.
- ✗
fsGroup: 1000
Why it's wrong here
The fsGroup: 1000 field configures the group ownership of any volumes mounted by the pod, setting their group ID to 1000 to allow access, but it has no effect on the UID of the container's processes. The process would still run as the image's default user, typically root unless runAsUser is specified, so it cannot fulfill the requirement to run as non-root user UID 1000.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.