CKAD Practice Question: Application Environment, Configuration and Security
Which THREE of the following are valid fields in a PodSecurityPolicy (PSP) that control Linux capabilities? (Select exactly 3)
⚠ Common exam trap
CNCF often tests the distinction between fields that directly control capabilities (like `allowedCapabilities`, `defaultAddCapabilities`, `requiredDropCapabilities`) and other security-related fields (like `privileged` or `readOnlyRootFilesystem`) that serve different purposes, causing candidates to select options that are not capability-specific.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
defaultAddCapabilities
`defaultAddCapabilities` is a valid field in a PodSecurityPolicy (PSP) that specifies a list of Linux capabilities to be added to containers by default, even if not explicitly requested in the container's security context. This field is part of the PSP's capabilities control mechanism, as defined in the Kubernetes PodSecurityPolicy spec.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
privileged
Why it's wrong here
The `privileged` field is a boolean in a PodSecurityPolicy that, when true, allows containers to run in privileged mode, granting them all capabilities and host access. It does not directly define a list of capabilities to add or drop, so it is not one of the capability-focused fields the question targets.
- ✓
defaultAddCapabilities
Why this is correct
`defaultAddCapabilities` specifies a list of Linux capabilities that are appended to the `default` set of capabilities for every container created under the policy. It is a valid capability field because it directly controls which capabilities are added by default, complementing the container runtime defaults.
- ✗
readOnlyRootFilesystem
Why it's wrong here
`readOnlyRootFilesystem` is a field in PodSecurityPolicy that forces a container's root filesystem to be mounted read-only, a security hardening measure entirely separate from capability management. It does not influence the Linux capability sets, making it irrelevant to the capability-specific question.
- ✓
requiredDropCapabilities
Why this is correct
`requiredDropCapabilities` explicitly lists capabilities that must be removed from every container's capability set, regardless of the image or runtime configuration. It is a valid field because it enforces a mandatory reduction of privileges, ensuring that dangerous capabilities are always dropped even if the container image requests them.
- ✓
allowedCapabilities
Why this is correct
`allowedCapabilities` enumerates the Linux capabilities that a container may explicitly request to add beyond the default set defined by the runtime. This field governs which additional capabilities are permitted without requiring a privileged container, making it a core capability management field for fine-grained access control.
Go deeper
Related to this question
About these practice questions
One of 826 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.