hardMultiple Choice
Kubernetes Pod Security Risks for CompTIA SecurityX / CASP+
A security team is auditing a Kubernetes cluster. They find a pod running with `securityContext`: `privileged: true` and `runAsUser: 0`. Which of the following is the most critical risk?
Quick Answer
The answer is the pod can access all node resources and potentially escape to the host. This is because setting `securityContext` to `privileged: true` disables all container runtime security restrictions, effectively giving the container the same capabilities as a process running directly on the node, while `runAsUser: 0` runs it as root, removing any user-based isolation. On the CompTIA SecurityX CAS-004 exam, this scenario tests your understanding of container escape vectors and the principle of least privilege in Kubernetes security. A common trap is confusing resource exhaustion (Option C) with a privilege escalation risk, or assuming a privileged container is automatically a network threat. Remember the mnemonic: "Privileged plus root equals host escape route" — if both conditions are met, the container has no boundaries between itself and the underlying node.
⚠ Common exam trap
A common misconception is that privileged mode only affects resource limits or network policies, when in fact it removes all kernel-level isolation, enabling container escape to the host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pod can access all node resources and potentially escape to the host.
Setting `privileged: true` and `runAsUser: 0` (root) in a pod's securityContext grants the container unrestricted access to the host's kernel capabilities. This effectively disables all container isolation, allowing the container to perform privileged operations such as loading kernel modules, accessing raw block devices, and using `nsenter` or `chroot` to escape the container and gain root-level access to the underlying node. This is the most critical risk because it directly compromises the host and potentially the entire cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pod cannot communicate with other pods.
Why it's wrong here
A privileged pod running as root can access the host and other workloads, so loss of pod-to-pod communication is not the risk. Network isolation is unrelated to securityContext. This option is tempting because connectivity failures are common, but privileged root access is the critical escalation risk here.
- ✗
The pod cannot mount volumes.
Why it's wrong here
A privileged pod running as root can mount host paths and access the node's devices, so volume mounting is not blocked. The option is tempting because privileged containers do bypass some admission policies, but the concrete risk is node and host filesystem compromise, not a loss of volume capability.
- ✓
The pod can access all node resources and potentially escape to the host.
Why this is correct
Privileged mode disables container isolation, granting the pod full access to host devices, kernel capabilities and node resources. Combined with runAsUser 0, a compromise can mount the host filesystem and escape the container to control the node.
- ✗
The pod will be killed by Kubernetes if it consumes too much memory.
Why it's wrong here
Memory limits are enforced by the kubelet through cgroup limits regardless of privileged mode or runAsUser, so excessive consumption triggers eviction independently. It is tempting because resource exhaustion is a real operational concern, but the security finding here is root-level host access, not memory pressure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security auditor reviews this Kubernetes pod configuration. Which security vulnerability is most critical?
hard- A.The container image is from a public registry and should use a private one.
- B.The container runs as non-root, but root access is required for certain operations.
- C.The container allows privilege escalation, which should be disabled.
- ✓ D.The hostPath volume mount provides direct filesystem access to the host, enabling potential container escape.
Why D: A hostPath volume mount grants the container direct read/write access to the host filesystem. If an attacker compromises the container, they can modify critical host files (e.g., /etc/shadow, /var/lib/kubelet) to escape the container and gain root access on the node. This is the most critical vulnerability because it bypasses container isolation entirely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.