KCSA Platform Security Practice Question
A platform engineer is hardening a container runtime setup on worker nodes. They want to ensure that containers cannot make unauthorized changes to network configurations or mount host filesystems. Which capability must be explicitly dropped from the default container capabilities set?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CAP_SYS_ADMIN
The 'CAP_SYS_ADMIN' capability grants a broad range of administrative privileges, including mounting filesystems and modifying kernel parameters, and should be dropped in hardened environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CAP_CHOWN
Why it's wrong here
CAP_CHOWN allows making arbitrary changes to file UIDs and GIDs, which is less dangerous than full system administration.
- ✗
CAP_NET_BIND_SERVICE
Why it's wrong here
CAP_NET_BIND_SERVICE allows binding to ports below 1024, which is commonly required and relatively low risk compared to SYS_ADMIN.
- ✓
CAP_SYS_ADMIN
Why this is correct
CAP_SYS_ADMIN is a powerful capability often referred to as the root-equivalent capability for system administration tasks and should be dropped.
- ✗
CAP_DAC_OVERRIDE
Why it's wrong here
While DAC override bypasses file read, write, and execute permission checks, SYS_ADMIN is the primary capability needed for mounting and kernel control.
About these practice questions
This KCSA question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.