CAS-004 AppArmor Practice Question
A company is deploying containers in a Kubernetes cluster and needs to enforce that containers run with reduced capabilities. Which Linux security feature should be configured to drop unnecessary capabilities?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AppArmor
To drop unnecessary capabilities in a Linux container, the correct Linux security feature is AppArmor. AppArmor is a Mandatory Access Control (MAC) system that can be configured with profiles to restrict capabilities granted to processes. By defining an AppArmor profile that drops specific capabilities (e.g., using the 'capability' rule set to deny), administrators can enforce that containers run with reduced privileges. While Seccomp filters system calls, it does not directly manage capabilities. PodSecurityPolicy is a Kubernetes resource, not a Linux feature. SELinux can also control capabilities but is more complex and less commonly used for this specific purpose in container environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PodSecurityPolicy
Why it's wrong here
PodSecurityPolicy is a Kubernetes resource for controlling pod security settings, but it is not a Linux security feature and does not directly drop capabilities at the kernel level.
- ✗
Seccomp
Why it's wrong here
Seccomp is a Linux feature that restricts system calls, not capabilities. It can indirectly limit capability-related syscalls, but it is not the primary mechanism for dropping capabilities.
- ✓
AppArmor
Why this is correct
AppArmor is a Linux MAC system that can be configured to drop specific capabilities using its profile language, making it the correct choice for directly managing capabilities in containers.
- ✗
SELinux
Why it's wrong here
SELinux enforces mandatory access controls through security contexts and policies on files, processes, and sockets, but it does not provide a mechanism to drop kernel capabilities from a container’s process. The scenario requires reducing the set of permitted Linux capabilities (e.g., `CAP_NET_RAW`), which is achieved by configuring `securityContext.capabilities.drop` in the Kubernetes pod spec, not by SELinux policy. It is tempting because SELinux is a prominent Linux security module used to confine container workloads in production, and it would be the correct choice if the requirement were to restrict a container’s access to specific filesystem objects or network resources via type enforcement, rather than to drop capabilities.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.