GSEC Container Security Practice Question
A security analyst is examining a Kubernetes Pod specification that includes the following securityContext: runAsUser: 0. What is the security implication of this setting?
⚠ Common exam trap
The trap here is misinterpreting runAsUser: 0 as a security hardening measure, when it actually runs the container as root and weakens security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The container will run as the root user, increasing the risk of privilege escalation if compromised.
Specifying runAsUser: 0 in a Kubernetes securityContext forces the container to run as the root user. This violates the principle of least privilege and increases the potential impact of a container compromise. Best practice is to run containers as a non-root user, often defined in the image or via runAsUser with a high UID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container will be unable to write to any mounted volumes due to permission restrictions.
Why it's wrong here
Running as root typically grants full permissions to write to mounted volumes, unless volume permissions are specifically restricted. This setting does not prevent writing; it actually gives broad access. The security concern is elevated privileges, not restricted access.
- ✓
The container will run as the root user, increasing the risk of privilege escalation if compromised.
Why this is correct
Setting runAsUser: 0 explicitly runs the container process as the root user (UID 0). If an attacker compromises the container, they gain root privileges within the container, which can be leveraged to escape to the host or access sensitive resources, especially if combined with other misconfigurations like hostPath mounts.
- ✗
The container will run as a non-privileged user, enhancing security by default.
Why it's wrong here
runAsUser: 0 specifies UID 0, which is the root user. This is the opposite of running as a non-privileged user. In Kubernetes, the default is often to run as the user defined in the image, which may be root, but explicitly setting UID 0 ensures root privileges.
- ✗
The container will automatically drop all Linux capabilities, reducing its attack surface.
Why it's wrong here
runAsUser: 0 does not affect Linux capabilities; capabilities are controlled separately via securityContext.capabilities. Running as root often retains default capabilities, which can be dangerous. Dropping capabilities is a separate security best practice that must be explicitly configured.
About these practice questions
Courseiva writes every GSEC question from scratch — 351 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.