Question 391 of 968
hardMultiple ChoiceObjective-mapped
Kubernetes Pod Security Context for Container Escape Prevention
A security engineer is hardening a Kubernetes cluster. They want to reduce the risk of container escape attacks. Which combination of settings is most effective at the pod security context level?
Quick Answer
The answer is setting runAsNonRoot: true, readOnlyRootFilesystem: true, and dropping all capabilities with drop: ['ALL']. This combination is most effective for Kubernetes pod security context to prevent container escape because it directly eliminates the three primary vectors attackers exploit: running as root grants full host access, a writable filesystem allows binary injection or kernel module loading, and default capabilities like CAP_SYS_ADMIN enable namespace escape. On the CompTIA SecurityX CAS-004 exam, this question tests your ability to apply least-privilege principles within a pod security context, often appearing as a multi-select scenario where distractors include privileged mode (which bypasses all restrictions) or leaving default capabilities intact. A common trap is confusing dropping all capabilities with running as non-root alone—both are needed. Memory tip: think “No root, no write, no caps” to recall the three pillars of container escape prevention.
⚠ Common exam trap
The CAS-004 exam often tests the misconception that setting a specific `runAsUser` (like 1000) is equivalent to enforcing non-root execution, when in fact `runAsNonRoot: true` is the explicit directive that prevents root UID (0) from being used, regardless of the numeric UID set.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].
Setting `runAsNonRoot: true` prevents the container from running as the root user, `readOnlyRootFilesystem: true` prevents writes to the container's root filesystem, and dropping all Linux capabilities with `drop: ['ALL']` removes all kernel privileges. Together, these three settings at the pod security context level drastically reduce the attack surface for container escape attacks by eliminating common privilege escalation vectors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set runAsNonRoot: true, readOnlyRootFilesystem: true, and drop: ['ALL'].
Why this is correct
Drops all capabilities, enforces non-root, and read-only filesystem – defense in depth against escapes.
- ✗
Set runAsNonRoot: false and readOnlyRootFilesystem: true.
Why it's wrong here
Running as root with a read-only filesystem still permits kernel exploits.
- ✗
Set runAsUser: 1000 and capabilities.add: ['NET_ADMIN'].
Why it's wrong here
Adding capabilities expands the attack surface; NET_ADMIN can be exploited.
- ✗
Set privileged: true and readOnlyRootFilesystem: false.
Why it's wrong here
Privileged mode grants excessive kernel access, increasing escape risk.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is reviewing a Kubernetes deployment where the pod spec includes `securityContext: { privileged: true }`. What is the primary security concern of this configuration?
hard- A.The container can access host resources like the filesystem
- B.The container can run as root
- C.The container has unrestricted network access
- ✓ D.The container can modify the host's kernel
Why D: Privileged containers have almost all capabilities of the host, including access to host devices and kernel modules. This significantly increases the attack surface compared to running as root alone.
Variation 2. A security engineer is implementing container security controls. Which TWO practices are most effective in preventing privilege escalation within a container? (Choose two.)
medium- ✓ A.Dropping all capabilities (CAP_DROP=ALL)
- B.Enabling SELinux
- C.Using host networking
- D.Mounting /var/run/docker.sock
- ✓ E.Setting USER to non-root in the Dockerfile
Why A: Dropping all capabilities with `CAP_DROP=ALL` removes all Linux capabilities from the container, effectively preventing any process inside from performing privileged operations such as changing user IDs, mounting filesystems, or accessing kernel features that could lead to privilege escalation. This is a fundamental container security best practice, as capabilities are the primary mechanism for granting fine-grained privileges to container processes.
Last reviewed: Jul 4, 2026
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.