hardMultiple Choice
CKS Practice Question: Uses Kubernetes with multiple namespaces and…
An organization uses Kubernetes with multiple namespaces and wants to ensure that containers running as non-root cannot escalate to root via setuid binaries. Which combination of security contexts and Pod Security Standards achieves this?
⚠ Common exam trap
CNCF often tests the misconception that simply running as a non-root user (e.g., `runAsUser: 1000`) is sufficient to prevent privilege escalation, but without `allowPrivilegeEscalation: false`, setuid binaries can still be exploited to gain root.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the 'restricted' Pod Security Standard at the namespace level.
The 'restricted' Pod Security Standard (PSS) enforces the strongest set of security constraints, including preventing containers from running as root and disallowing privilege escalation. Specifically, it requires `securityContext.allowPrivilegeEscalation: false` and prohibits running as root, which directly blocks escalation via setuid binaries. Applying this standard at the namespace level ensures all pods in that namespace inherit these controls, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an AppArmor profile to block setuid syscalls.
Why it's wrong here
AppArmor profiles are Linux security modules that are not a built-in Kubernetes admission-control mechanism; Kubernetes Pod Security Standards are enforced via the PodSecurity admission controller at the namespace level. Even if a node has a setuid-blocking AppArmor profile, it only constrains syscalls on that node, not workloads in all namespaces, and it does not enforce core PSS requirements like runAsNonRoot or allowPrivilegeEscalation. Therefore, it is not an appropriate or standard way to apply a namespace-wide security baseline.
- ✓
Apply the 'restricted' Pod Security Standard at the namespace level.
Why this is correct
The 'restricted' Pod Security Standard (PSS) is the most stringent namespace-level admission policy. It requires runAsNonRoot: true, sets allowPrivilegeEscalation: false, prohibits privileged containers, and enforces a seccomp profile of RuntimeDefault or Localhost. Applying this at namespace level ensures every pod is evaluated by the PodSecurity admission controller, directly blocking privileged escalation and setuid-based uid transitions.
- ✗
Set 'securityContext.runAsUser: 1000' on each pod spec.
Why it's wrong here
Setting securityContext.runAsUser: 1000 only changes the initial UID of the container process; it does not disable setuid binaries, so a process running as UID 1000 can still execute a binary with the setuid bit set and gain root privileges. Moreover, specifying runAsUser is per-pod or per-container, so it lacks the namespace-wide enforcement needed to uniformly secure every workload. The PSS 'restricted' policy instead uses runAsNonRoot to reject containers that could run as root, combined with allowPrivilegeEscalation: false.
- ✗
Apply the 'baseline' Pod Security Standard with 'seccompProfile: RuntimeDefault'.
Why it's wrong here
The 'baseline' Pod Security Standard is deliberately less restrictive; it allows the container to run as root and does not require runAsNonRoot, so a setuid binary could still elevate privileges. Adding seccompProfile: RuntimeDefault only confines kernel syscalls but does not prevent UID transitions via setuid, nor does it set allowPrivilegeEscalation: false. The correct fix is 'restricted', which enforces a default-deny posture on privilege escalation rather than relying on a single seccomp profile.
Go deeper
Related to this question
Learn chapter
Microservice Vulnerabilities: Pod Security Standards
Key term
Pod Security Admission
Pod Security Admission is a Kubernetes feature that enforces security standards on pods at creation time to prevent running containers with dangerous privileges.
Key term
Pod Security Standards
Pod Security Standards are a set of predefined Kubernetes policies that control the security context of pods to prevent privilege escalation and enforce least privilege.
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.