Question 694 of 720
CKS System Hardening Practice Question
Which of the following is NOT a recommended method to reduce the attack surface on Kubernetes nodes?
⚠ Common exam trap
Watch out — candidates often confuse 'privileged containers' with 'containers running as root' and incorrectly think that running as non-root is the only requirement, when in fact privileged mode grants far more dangerous host-level access regardless of the user ID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Running containers with privileged: true
Setting `privileged: true` in a container's security context grants it elevated capabilities equivalent to running as root on the host, including access to all kernel namespaces and devices. This directly increases the attack surface by allowing the container to perform host-level operations, such as loading kernel modules or modifying network settings, which violates the principle of least privilege. The CKS exam emphasizes that privileged containers should be avoided unless absolutely necessary, and they are never a recommended method for reducing the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using read-only root filesystems
Why it's wrong here
This reduces attack surface.
- ✗
Running containers as non-root
Why it's wrong here
This reduces attack surface.
- ✓
Running containers with privileged: true
Why this is correct
Privileged containers have elevated capabilities, increasing attack surface.
- ✗
Disabling unnecessary system services on nodes
Why it's wrong here
This reduces attack surface.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.