CKS Minimize Microservice Vulnerabilities Practice Question
You are implementing a policy to ensure all containers in a namespace run as non-root. Which of the following is the most appropriate approach to enforce this at the cluster level?
⚠ Common exam trap
A common pitfall in the CKS exam is assuming that PodSecurityPolicy (PSP) is still a viable cluster-level enforcement mechanism. However, PSP was deprecated in Kubernetes v1.21 and removed in v1.25. The modern approach uses either OPA/Gatekeeper with ConstraintTemplates or Kubernetes Pod Security Standards (PSS) via labels or built-in admission controllers. Candidates often choose PSP out of habit, but it is no longer available in recent clusters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use OPA/Gatekeeper with a ConstraintTemplate that checks runAsNonRoot is set to true
OPA/Gatekeeper allows you to enforce custom policies at the cluster level via ConstraintTemplates and Constraints. By creating a ConstraintTemplate that checks `runAsNonRoot: true` in the Pod securityContext, you can ensure all Pods in a namespace (or cluster-wide) run as non-root, without modifying individual Pod specs. This approach is native to Kubernetes admission control and provides a flexible, cluster-wide enforcement mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a PodSecurityPolicy that requires runAsNonRoot
Why it's wrong here
PodSecurityPolicy is deprecated in Kubernetes 1.25+ and removed in 1.29. It should not be used for new deployments.
- ✓
Use OPA/Gatekeeper with a ConstraintTemplate that checks runAsNonRoot is set to true
Why this is correct
OPA/Gatekeeper can enforce policies via admission webhooks, and a ConstraintTemplate can validate that all containers have runAsNonRoot: true.
- ✗
Set runAsNonRoot in the securityContext of each Pod spec manually
Why it's wrong here
This does not enforce the policy cluster-wide; it only applies to specific pods. It is not scalable.
- ✗
Configure a ValidatingAdmissionPolicy with a CEL rule requiring runAsNonRoot
Why it's wrong here
While ValidatingAdmissionPolicy (beta) could be used, OPA/Gatekeeper is the more mature and commonly used tool for such policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.