Courseiva
← CAS-005
Full test
hardMultiple ChoiceObjective-mapped

Kubernetes Pod Security Risks for CompTIA SecurityX / CASP+

A security team is auditing a Kubernetes cluster. They find a pod running with `securityContext`: `privileged: true` and `runAsUser: 0`. Which of the following is the most critical risk?

Quick Answer

The answer is the pod can access all node resources and potentially escape to the host. This is because setting `securityContext` to `privileged: true` disables all container runtime security restrictions, effectively giving the container the same capabilities as a process running directly on the node, while `runAsUser: 0` runs it as root, removing any user-based isolation. On the CompTIA SecurityX CAS-004 exam, this scenario tests your understanding of container escape vectors and the principle of least privilege in Kubernetes security. A common trap is confusing resource exhaustion (Option C) with a privilege escalation risk, or assuming a privileged container is automatically a network threat. Remember the mnemonic: "Privileged plus root equals host escape route" — if both conditions are met, the container has no boundaries between itself and the underlying node.

⚠ Common exam trap

A common misconception is that privileged mode only affects resource limits or network policies, when in fact it removes all kernel-level isolation, enabling container escape to the host.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The pod can access all node resources and potentially escape to the host.

Setting `privileged: true` and `runAsUser: 0` (root) in a pod's securityContext grants the container unrestricted access to the host's kernel capabilities. This effectively disables all container isolation, allowing the container to perform privileged operations such as loading kernel modules, accessing raw block devices, and using `nsenter` or `chroot` to escape the container and gain root-level access to the underlying node. This is the most critical risk because it directly compromises the host and potentially the entire cluster.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The pod cannot communicate with other pods.

    Why it's wrong here

    Privileged mode does not restrict network communication.

  • ✗

    The pod cannot mount volumes.

    Why it's wrong here

    Privileged mode allows mounting volumes.

  • ✓

    The pod can access all node resources and potentially escape to the host.

    Why this is correct

    Privileged mode grants unrestricted host access.

  • ✗

    The pod will be killed by Kubernetes if it consumes too much memory.

    Why it's wrong here

    Memory limits are separate from security context.

About these practice questions

Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on CAS-005

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security auditor reviews this Kubernetes pod configuration. Which security vulnerability is most critical?

hard
  • A.The container image is from a public registry and should use a private one.
  • B.The container runs as non-root, but root access is required for certain operations.
  • C.The container allows privilege escalation, which should be disabled.
  • ✓ D.The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.

Why D: A hostPath volume mount grants the container direct read/write access to the host filesystem. If an attacker compromises the container, they can modify critical host files (e.g., /etc/shadow, /var/lib/kubelet) to escape the container and gain root access on the node. This is the most critical vulnerability because it bypasses container isolation entirely.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.