mediumMultiple SelectObjective-mapped
XK0-006 Practice Question: Which TWO statements about container security are…
Which TWO statements about container security are correct when using Docker? (Choose two.)
⚠ Common exam trap
CompTIA often tests the misconception that containers have their own kernel or that SELinux is automatically active, while the real focus is on Linux capabilities and the shared kernel model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using --cap-drop=ALL removes all capabilities, making the container more secure.
Using `--cap-drop=ALL` removes all Linux capabilities from the container, which eliminates any privileged operations the container could perform. This forces the container to run with the absolute minimum privileges, significantly reducing the attack surface and making it more secure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SELinux is automatically enabled inside containers.
Why it's wrong here
SELinux must be configured; it's not automatically enabled.
- ✗
Containers have their own kernel, isolated from the host.
Why it's wrong here
Containers share the host kernel.
- ✓
Using --cap-drop=ALL removes all capabilities, making the container more secure.
Why this is correct
Dropping all capabilities and adding only needed ones is a security best practice.
- ✓
By default, containers run with a reduced set of Linux capabilities.
Why this is correct
Docker drops many capabilities by default for security.
- ✗
Using --network=host increases container isolation.
Why it's wrong here
Host network reduces isolation by sharing the host's network stack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.