KCSA Kubernetes Threat Model Practice Question
What is the primary risk associated with running containers as the `root` user (`runAsUser: 0` or omitting the user directive)?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
If a container escape vulnerability occurs, the attacker immediately obtains root privileges on the underlying host.
Running as root inside the container means the process has root privileges inside the container namespace, and if a container escape vulnerability exists, the attacker immediately gains root access on the host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
If a container escape vulnerability occurs, the attacker immediately obtains root privileges on the underlying host.
Why this is correct
Container root maps directly to host root or powerful UID 0 capabilities in misconfigured or un-namespaced environments, easing host compromise.
- ✗
It prevents the kubelet from restarting the container upon failure.
Why it's wrong here
Restart policies are handled by container restart backoff logic and kubelet controllers, not container UIDs.
- ✗
It disables the container runtime engine's ability to pull images from private registries.
Why it's wrong here
Image pulling requires imagePullSecrets, not specific container user execution UIDs.
- ✗
It forces the CNI plugin to drop network packets destined for external IPs.
Why it's wrong here
User IDs do not affect CNI packet routing decisions.
About these practice questions
One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.