hardMultiple ChoiceObjective-mapped

CAS-004 Practice Question: A Kubernetes pod is defined with the above…

Exhibit

apiVersion: v1
kind: Pod
metadata:
  name: security-pod
spec:
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      capabilities:
        add: ["NET_ADMIN", "SYS_ADMIN"]
      readOnlyRootFilesystem: true

A Kubernetes pod is defined with the above manifest. Which security concern is most critical?

⚠ Common exam trap

Candidates often mistakenly choose running as root as the most critical issue, but the added capabilities NET_ADMIN and SYS_ADMIN are more dangerous because they directly enable host-level attacks, bypassing container isolation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.

Granting NET_ADMIN and SYS_ADMIN capabilities to a container in a Kubernetes pod violates the principle of least privilege and can allow an attacker to manipulate network settings (e.g., iptables, routing) and perform system-level operations (e.g., mount, swapon) that break out of container isolation. These capabilities are not required for most workloads and directly undermine the security boundaries enforced by Linux namespaces and cgroups.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The image tag "latest" might pull an outdated image.
Why it's wrong here
Outdated images may have vulnerabilities, but the immediate risk is the capabilities.
✓
The pod has added capabilities NET_ADMIN and SYS_ADMIN, which could allow network manipulation and system administration.
Why this is correct
These capabilities can lead to container escape or host compromise.
✗
The readOnlyRootFilesystem prevents logging.
Why it's wrong here
Logging can be redirected to stdout or volumes; this is not a security risk.
✗
The pod runs as root by default.
Why it's wrong here
Default root is a concern, but capabilities are more critical.

Go deeper

CAS-004 Practice Question: A Kubernetes pod is defined with the above…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question