KCNA Kubernetes Fundamentals Practice Question
A pod in the 'default' namespace has the following YAML snippet: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 What is the effect of the fsGroup field?
⚠ Common exam trap
A common trap is confusing the role of `runAsGroup` (which sets the primary GID of the container process) with `fsGroup` (which sets the group ownership of mounted volumes), leading candidates to incorrectly select option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It sets the group ID for any volumes mounted into the pod.
The `fsGroup` field in a Pod's security context sets the group ID (GID) that will be used for ownership of any volumes mounted into the pod. When a volume is mounted, Kubernetes recursively changes the group ownership of the volume's files to the specified GID (2000 in this case) and makes them readable and writable by that group. This ensures that processes running in the container, which may have a different primary group (3000 from `runAsGroup`), can still access the volume files if they are members of the fsGroup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It restricts the pod to run only on nodes with that group ID.
Why it's wrong here
Node selection uses nodeSelector or affinity, not fsGroup.
- ✓
It sets the group ID for any volumes mounted into the pod.
Why this is correct
fsGroup changes the group ownership of volumes and any files created in them.
- ✗
It defines the group ID for the pod's service account.
Why it's wrong here
Service account has no relation to fsGroup.
- ✗
It sets the group ID for the container's main process.
Why it's wrong here
runAsGroup sets the primary group for the container process.
Go deeper
Related to this question
About these practice questions
Courseiva writes every KCNA question from scratch — 833 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.