KCSA Platform Security Practice Question
Which TWO configuration practices improve container runtime security on Kubernetes nodes? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforcing non-root execution via container securityContext
Runtime security is improved by using non-root users and ensuring root filesystems are read-only where possible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enforcing non-root execution via container securityContext
Why this is correct
Running containers as non-root reduces the blast radius of container escapes.
- ✗
Mounting the Docker socket inside application containers
Why it's wrong here
Mounting the Docker socket grants full cluster-admin access to the container and must be avoided.
- ✓
Using read-only root filesystems to prevent tampering with binaries
Why this is correct
Read-only root filesystems prevent attackers from modifying application files or writing malware.
- ✗
Disabling all seccomp and AppArmor profiles
Why it's wrong here
Disabling security profiles removes crucial kernel-level sandboxing features.
- ✗
Granting CAP_SYS_ADMIN to all containers by default
Why it's wrong here
Granting CAP_SYS_ADMIN increases privileges and weakens node isolation.
About these practice questions
Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.