hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security auditor reviews this Kubernetes pod…
Exhibit
Refer to the exhibit.
```yaml
apiVersion: v1
kind: Pod
metadata:
name: web-server
spec:
containers:
- name: nginx
image: nginx:latest
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- name: host-volume
mountPath: /data
volumes:
- name: host-volume
hostPath:
path: /var/data
type: Directory
```A security auditor reviews this Kubernetes pod configuration. Which security vulnerability is most critical?
⚠ Common exam trap
CompTIA often tests the distinction between a 'best practice' (like using a private registry) and a 'critical vulnerability' (like hostPath mounts that break isolation), tricking candidates into choosing a less severe but more commonly discussed issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.
A hostPath volume mount grants the container direct read/write access to the host filesystem. If an attacker compromises the container, they can modify critical host files (e.g., /etc/shadow, /var/lib/kubelet) to escape the container and gain root access on the node. This is the most critical vulnerability because it bypasses container isolation entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container image is from a public registry and should use a private one.
Why it's wrong here
Using public images is common but the critical vulnerability is the hostPath mount.
- ✗
The container runs as non-root, but root access is required for certain operations.
Why it's wrong here
Non-root is a best practice; the configuration correctly sets runAsNonRoot: true.
- ✗
The container allows privilege escalation, which should be disabled.
Why it's wrong here
allowPrivilegeEscalation is set to false, so escalation is disabled.
- ✓
The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.
Why this is correct
HostPath mounts give the container access to the host filesystem; if compromised, the attacker can manipulate host files.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.