hardMultiple Choice

CAS-004 Practice Question: A Kubernetes pod is defined with the above…

Exhibit

apiVersion: v1
kind: Pod
metadata:
  name: security-pod
spec:
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      capabilities:
        add: ["NET_ADMIN", "SYS_ADMIN"]
      readOnlyRootFilesystem: true

A Kubernetes pod is defined with the above manifest. Which security concern is most critical?

⚠ Common exam trap

Candidates often mistakenly choose running as root as the most critical issue, but the added capabilities NET_ADMIN and SYS_ADMIN are more dangerous because they directly enable host-level attacks, bypassing container isolation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.

Granting NET_ADMIN and SYS_ADMIN capabilities to a container in a Kubernetes pod violates the principle of least privilege and can allow an attacker to manipulate network settings (e.g., iptables, routing) and perform system-level operations (e.g., mount, swapon) that break out of container isolation. These capabilities are not required for most workloads and directly undermine the security boundaries enforced by Linux namespaces and cgroups.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The image tag "latest" might pull an outdated image.
Why it's wrong here
A mutable latest tag risks unpredictable image versions, yet the manifest's explicit securityContext configuration is the critical concern being tested. Pinning tags matters in production pipelines where reproducibility and supply-chain integrity are the graded requirement.
✓
The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.
Why this is correct
NET_ADMIN permits interface, routing and firewall manipulation, while SYS_ADMIN grants broad administrative operations such as mounting filesystems. Combined in one container, these capabilities enable privilege escalation and host or network compromise, outweighing the other manifest settings.
✗
The readOnlyRootFilesystem prevents logging.
Why it's wrong here
readOnlyRootFilesystem restricts writes to the container filesystem; it does not prevent logging, since logs are typically written to stdout or mounted volumes. It would be the correct hardening choice when preventing runtime tampering with container binaries.
✗
The pod runs as root by default.
Why it's wrong here
Running as root is a genuine hardening gap, but the manifest's explicit securityContext settings are the graded concern; root-by-default is not the critical issue here. It would matter in a manifest lacking runAsNonRoot, where no other control mitigates privilege escalation.

Go deeper

CAS-004 Practice Question: A Kubernetes pod is defined with the above…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question