CS0-003 Vulnerability Management Practice Question
An organization is implementing security hardening for Kubernetes clusters. Which THREE of the following are common Kubernetes misconfigurations that should be addressed? (Select THREE)
⚠ Common exam trap
CS0-004 often tests whether candidates can distinguish security best practices (namespaces, network policies) from actual misconfigurations (hostPath, privileged mode, permissive RBAC); selecting a best practice as a misconfiguration is the common error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using hostPath mounts without restrictions
Option C is correct because hostPath mounts without restrictions let a pod access the node's filesystem, enabling container escape, node compromise, and tampering with kubelet or other host files, so they should be limited via Pod Security Admission or OPA/Gatekeeper policies. Option D is correct because privileged containers run with all Linux capabilities and unrestricted device access, effectively granting root on the host and bypassing container isolation, so privileged: true should be disallowed except for tightly controlled system workloads. Option E is correct because overly permissive RBAC roles, such as wildcard verbs/resources or cluster-admin bindings, violate least privilege and let compromised service accounts read secrets, create pods, or escalate across the cluster. Options A and B are not misconfigurations: using namespaces to isolate workloads and implementing network policies are recommended hardening practices that segment resources and restrict pod-to-pod traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using namespaces to isolate workloads
Why it's wrong here
Namespaces are a built-in Kubernetes mechanism for resource isolation and administrative partitioning, but they do not restrict the host kernel attack surface or contain a compromised container from escalating to the node. Using namespaces to isolate workloads is a standard security best practice, and failing to use them would be a misconfiguration, not the other way around. Therefore, this is not a hardening mistake.
- ✗
Implementing network policies
Why it's wrong here
Network policies are declarative rules that control ingress and egress traffic between pods, enforcing least-privilege segmentation and limiting lateral movement after an initial compromise. They are a recommended security control rather than a configuration weakness; they strengthen the cluster's network boundary. Implementing network policies is part of a proper hardening process, so it is not a misconfiguration.
- ✓
Using hostPath mounts without restrictions
Why this is correct
HostPath mounts allow a pod to mount an arbitrary path from the underlying node's filesystem directly into the container. Without restrictions such as requiring read-only mounts, allowing only specific directories, or disabling hostPath when possible, a compromised container can read or modify sensitive host files, plant malicious executables, or even achieve full node compromise. This is a critical misconfiguration that directly exposes the host and is absolutely a security risk.
- ✓
Running containers in privileged mode
Why this is correct
Privileged containers run with most capabilities that the root user has on the host, effectively disabling seccomp, AppArmor, and other Linux isolation mechanisms. This strips away the container's security boundary, allowing a compromised process to interact with kernel modules, devices, or host processes. Granting privileged mode to any container is a severe misconfiguration that undermines the entire isolation model of Kubernetes.
- ✓
Overly permissive RBAC roles
Why this is correct
Overly permissive RBAC roles assign more API permissions than a workload needs, such as wildcard verbs like '*' on resources or full cluster-admin privileges. If an attacker compromises a pod bound to such a role, they can create privileged pods, read secrets, or modify cluster-wide resources, quickly escalating to cluster takeover. This violates the principle of least privilege and is a common, dangerous misconfiguration.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Container Image Vulnerability Scanning
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.