CKAD SecurityContext Practice Question
A pod's container needs to run as non-root user with UID 1000 and ensure its filesystem is read-only. Which SecurityContext settings achieve this?
⚠ Common exam trap
The trap is that readOnlyRootFilesystem must be set at the container level, not the pod level. Option D appears to have all three settings but places readOnlyRootFilesystem at the pod level, which is invalid. Candidates often overlook the level at which securityContext fields are applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
spec: securityContext: runAsUser: 1000 runAsNonRoot: true containers: - name: app securityContext: readOnlyRootFilesystem: true
Ly sets runAsUser and runAsNonRoot at the pod level to enforce non-root execution with UID 1000, and readOnlyRootFilesystem at the container level, which is the correct placement for that field. The other options either use invalid fields (runAsRoot), omit runAsNonRoot, or incorrectly place readOnlyRootFilesystem at the pod level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
spec: securityContext: runAsUser: 1000 runAsNonRoot: true containers: - name: app securityContext: readOnlyRootFilesystem: true
Why this is correct
This is the correct placement because the pod-level `securityContext` can legally include `runAsUser: 1000` and `runAsNonRoot: true`, which enforces that the container runs with UID 1000 and validates it is not running as root. The container-level `securityContext` is the only place where `readOnlyRootFilesystem` is accepted, so putting it there makes the pod valid and the root filesystem read-only. This demonstrates the proper scope: pod-wide user and group settings at the pod level, container-specific settings like read-only filesystem at the container level.
- ✗
securityContext: runAsNonRoot: true runAsRoot: false readOnlyRootFilesystem: true
Why it's wrong here
This manifest fails because `runAsRoot` is not a recognized field in the Kubernetes securityContext schema; the correct field to declare a non-root user is `runAsUser`. It also omits `runAsUser`, so the container's UID is left unspecified, and setting `readOnlyRootFilesystem` at the pod level is invalid because that field can only be configured inside a container's `securityContext`. As written, the pod would not enforce the non-root requirement and would be rejected by the API server due to the unknown field.
- ✗
securityContext: runAsGroup: 1000 readOnlyRootFilesystem: true
Why it's wrong here
This configuration is wrong because `runAsGroup` only sets the primary group (GID) of the container processes; it does not constrain the user ID, so the container could still run as root if the image's USER is root. Since `runAsUser` is absent, the non-root requirement is never enforced. Additionally, `readOnlyRootFilesystem: true` is placed at the pod level, but this field is only valid under the container-level `securityContext`, not the pod-level one.
- ✗
securityContext: runAsNonRoot: true runAsUser: 1000 readOnlyRootFilesystem: true
Why it's wrong here
Although this manifest correctly sets `runAsUser: 1000` and `runAsNonRoot: true`, it incorrectly places `readOnlyRootFilesystem` at the pod level. In Kubernetes, `readOnlyRootFilesystem` is a container-level securityContext field; the API server will reject or ignore it if it appears directly under the pod's `securityContext`. To achieve both non-root execution and a read-only root filesystem, the read-only setting must be moved into the container's own `securityContext` block, as shown in the correct answer.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.