SY0-701 Security Architecture Practice Question
A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.
⚠ Common exam trap
Candidates often think running containers as root is necessary for app functionality, but Kubernetes security best practices (and the CIS Benchmark for Kubernetes) explicitly require running containers with non-root users and read-only root filesystems to limit damage from a compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require signed, scanned images from an approved registry before deployment.
Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface. This directly addresses the risk of deploying an altered image.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require signed, scanned images from an approved registry before deployment.
Why this is correct
Image signing and scanning help ensure the cluster only deploys trusted builds that have been checked for known vulnerabilities. Using an approved registry adds supply-chain control and reduces the chance of pulling tampered or unreviewed images. This directly addresses the risk of altered or unsafe container content entering production.
- ✗
Run each container as root so file permissions inside the container do not block apps.
Why it's wrong here
Running containers as root violates the principle of least privilege by granting excessive kernel capabilities, allowing a compromised process to facilitate container escapes and access host resources. This approach is used during initial application development or debugging to bypass permission hurdles when local file system ownership issues arise. In such scenarios, developers prioritise rapid deployment over security boundaries before hardening the runtime environment through Pod Security Admissions.
- ✓
Use namespaces and network policies to separate the workloads by trust zone.
Why this is correct
Namespaces and network policies provide logical separation inside a shared cluster, which is essential when multiple teams or customers coexist. They help prevent one workload from freely reaching another workload's services or data. This is the container equivalent of segmentation and supports tenant isolation.
- ✗
Mount the host filesystem into every pod so support staff can troubleshoot more quickly.
Why it's wrong here
Mounting the host filesystem into pods greatly expands the damage a compromised container can do. It also creates unnecessary access to host resources and sensitive paths. Troubleshooting convenience is not worth the security tradeoff in a shared environment.
- ✓
Run containers with the minimum Linux capabilities and a read-only root filesystem where possible.
Why this is correct
Dropping capabilities and using a read-only root filesystem reduce what an attacker can do even if a container is compromised. These settings limit privilege escalation paths and make persistent tampering harder. They are practical hardening controls that align with least privilege and stronger containment.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.