mediumMultiple ChoiceObjective-mapped

CAS-004 Practice Question: Refer to the exhibit

Exhibit

apiVersion: v1
kind: Pod
metadata:
  name: security-example
spec:
  containers:
  - name: my-container
    image: nginx:latest
    securityContext:
      capabilities:
        add: ["NET_ADMIN", "SYS_ADMIN"]

Refer to the exhibit. A security analyst reviews this pod specification. Which attack surface is most increased by the added capabilities?

⚠ Common exam trap

The CAS-004 exam often tests the distinction between broad container privileges (like `privileged: true`) and specific Linux capabilities, tricking candidates into thinking that 'privileged' only affects network or process controls, when in fact it grants all capabilities including `CAP_SYS_MODULE`, which is the most dangerous for host integrity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The container can install new kernel modules

The added capability of `CAP_SYS_MODULE` (or the equivalent `privileged: true` setting) allows the container to load and unload kernel modules. This directly increases the attack surface by enabling a container to modify the host kernel, potentially installing malicious modules that can bypass security controls, escalate privileges, or access sensitive kernel memory. Option D is correct because kernel module manipulation is a well-known path to host compromise in containerized environments.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The container can modify network settings
Why it's wrong here
NET_ADMIN allows network modification, but SYS_ADMIN is more severe.
✗
The container can kill other processes
Why it's wrong here
Killing processes requires CAP_KILL, not added here.
✗
The container can read all host files
Why it's wrong here
SYS_ADMIN does not directly allow reading all files; that requires other capabilities.
✓
The container can install new kernel modules
Why this is correct
SYS_ADMIN capability allows loading kernel modules, potentially compromising the host.

Go deeper

CAS-004 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question