Cloud Application Security →hardMultiple ChoiceObjective-mapped

CCSP Cloud Application Security Practice Question

Exhibit

Refer to the exhibit.

```
apiVersion: v1
kind: Pod
metadata:
  name: web-app
spec:
  containers:
  - name: web
    image: nginx:latest
    securityContext:
      runAsUser: 1000
      runAsGroup: 3000
      allowPrivilegeEscalation: false
    ports:
    - containerPort: 80
```

Refer to the exhibit. A Kubernetes pod is configured as shown. Which security enhancement should be added to follow cloud security best practices?

⚠ Common exam trap

ISC2 often tests the distinction between runtime hardening (like read-only filesystem) and identity/access controls (like runAsUser or image trust), expecting candidates to recognize that a non-root user alone does not prevent file tampering.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set readOnlyRootFilesystem to true

Setting `readOnlyRootFilesystem` to true ensures the container's root filesystem is mounted as read-only, preventing attackers from modifying binaries, libraries, or configuration files at runtime. This is a key container hardening practice that limits the blast radius of a compromise, aligning with the CIS Benchmark for Kubernetes and cloud security best practices.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set allowPrivilegeEscalation to true
Why it's wrong here
Setting to true would increase risk.
✗
Use a more restrictive runAsUser value like 2000
Why it's wrong here
Current value is already non-root; changing UID does not add security.
✓
Set readOnlyRootFilesystem to true
Why this is correct
Read-only root filesystem prevents unauthorized modifications.
✗
Use a trusted image from a private registry
Why it's wrong here
Image source is important but not shown as a vulnerability.

Quick reference

AAA Protocol Comparison

Protocol	Port(s)	Encryption	Transport	Primary Use
RADIUS	1812 / 1813	Password only	UDP	Network access control
TACACS+	49	Full packet	TCP	Device administration
Diameter	3868	Full session	TCP / SCTP	Carrier / mobile networks
802.1X	—	EAP-based	Layer 2	Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

Go deeper

CCSP Cloud Application Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AAA Protocol Comparison

Related to this question