Which of the following is a recommended security habit in Kubernetes?

The correct answer is B. Disallow privilege escalation from within a container as the default option. Disallowing privilege escalation by default is a Kubernetes security best practice. Privilege escalation allows a process inside a container to gain more privileges than its parent process, which attackers can exploit to break out of container isolation. Options A and C…

Submitted by eva_at· May 4, 2026Kubernetes Fundamentals

Question

Options

ARun the containers as the user with group ID 0 (root) and any user ID.
BDisallow privilege escalation from within a container as the default option.
CRun the containers as the user with user ID 0 (root) and any group ID.
DAllow privilege escalation from within a container as the default option.

How the community answered

(61 responses)

A
3% (2)
B
89% (54)
C
7% (4)
D
2% (1)

Explanation

Disallowing privilege escalation by default is a Kubernetes security best practice. Privilege escalation allows a process inside a container to gain more privileges than its parent process, which attackers can exploit to break out of container isolation. Options A and C advocate running containers as root (UID 0 or GID 0), which exposes the host system if a container is compromised. Option D explicitly allows privilege escalation, which is the direct opposite of a secure posture. Setting allowPrivilegeEscalation: false in the Pod security context enforces this restriction.

Topics

#Kubernetes security#Container security#Privilege escalation#Security best practices

Community Discussion

No community discussion yet for this question.

Full KCNA Practice