CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using namespaces to isolate workloads

  Why it's wrong here

  Namespaces are a built-in Kubernetes mechanism for resource isolation and administrative partitioning, but they do not restrict the host kernel attack surface or contain a compromised container from escalating to the node. Using namespaces to isolate workloads is a standard security best practice, and failing to use them would be a misconfiguration, not the other way around. Therefore, this is not a hardening mistake.

• ✗

  Implementing network policies

  Why it's wrong here

  Network policies are declarative rules that control ingress and egress traffic between pods, enforcing least-privilege segmentation and limiting lateral movement after an initial compromise. They are a recommended security control rather than a configuration weakness; they strengthen the cluster's network boundary. Implementing network policies is part of a proper hardening process, so it is not a misconfiguration.

• ✓

  Using hostPath mounts without restrictions

  Why this is correct

  HostPath mounts allow a pod to mount an arbitrary path from the underlying node's filesystem directly into the container. Without restrictions such as requiring read-only mounts, allowing only specific directories, or disabling hostPath when possible, a compromised container can read or modify sensitive host files, plant malicious executables, or even achieve full node compromise. This is a critical misconfiguration that directly exposes the host and is absolutely a security risk.

• ✓

  Running containers in privileged mode

  Why this is correct

  Privileged containers run with most capabilities that the root user has on the host, effectively disabling seccomp, AppArmor, and other Linux isolation mechanisms. This strips away the container's security boundary, allowing a compromised process to interact with kernel modules, devices, or host processes. Granting privileged mode to any container is a severe misconfiguration that undermines the entire isolation model of Kubernetes.

• ✓

  Overly permissive RBAC roles

  Why this is correct

  Overly permissive RBAC roles assign more API permissions than a workload needs, such as wildcard verbs like '*' on resources or full cluster-admin privileges. If an attacker compromises a pod bound to such a role, they can create privileged pods, read secrets, or modify cluster-wide resources, quickly escalating to cluster takeover. This violates the principle of least privilege and is a common, dangerous misconfiguration.

Go deeper

Related to this question