CCSP Cloud Application Security Practice Question
A retail company is migrating its monolithic e-commerce application to containers on a managed Kubernetes service. The security architect wants to ensure that if a container is compromised, the attacker cannot use the container's credentials to access the underlying node's filesystem or other pods' volumes. Which Kubernetes feature should be configured to meet this requirement?
⚠ Common exam trap
Many candidates confuse network or API authorization controls with runtime isolation of the container from the host and other workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Runtime sandboxing with gVisor or Kata Containers
The requirement is strong runtime isolation so a compromised container cannot reach the node or other pods' data. Runtime sandboxing with gVisor or Kata Containers creates a boundary beyond standard Linux namespaces and cgroups. Pod Security Admission, NetworkPolicy, and RBAC are valuable but address configuration hardening, network traffic, and API authorization respectively, not filesystem and volume isolation from the host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Role-Based Access Control (RBAC) to limit service account permissions
Why it's wrong here
RBAC limits what actions a service account can perform against the Kubernetes API, reducing the blast radius of stolen credentials. However, it does not isolate the container's runtime filesystem or prevent access to host paths and other pods' volumes. RBAC addresses API authorization, not runtime isolation, so it does not satisfy the stated requirement.
- ✗
NetworkPolicy to restrict pod-to-pod traffic
Why it's wrong here
NetworkPolicy controls network traffic between pods and namespaces, limiting lateral movement over the network. It does not prevent a compromised container from reading the node's filesystem or mounting another pod's volume. The requirement is about filesystem and volume isolation, so network controls alone are insufficient here.
- ✗
Pod Security Admission with the restricted profile
Why it's wrong here
Pod Security Admission with the restricted profile enforces hardening such as non-root users and dropped capabilities, which reduces risk but does not by itself isolate the container from the node filesystem or other pods' volumes. Without additional isolation mechanisms, a privileged or misconfigured container could still reach host paths. It is a useful baseline, not the specific isolation control requested.
- ✓
Runtime sandboxing with gVisor or Kata Containers
Why this is correct
Runtime sandboxing such as gVisor or Kata Containers provides a stronger isolation boundary between the container and the host kernel or node. gVisor intercepts syscalls in user space, while Kata runs containers in lightweight VMs. Both reduce the ability of a compromised container to access the node filesystem or other pods' volumes, directly meeting the isolation requirement.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.