Linux Foundation KCSA Exam - Topic 2 Question 13 Discussion

Actual exam question for Linux Foundation's KCSA exam

Question #: 13
Topic #: 2

[All KCSA Questions]

A container running in a Kubernetes cluster has permission to modify host processes on the underlying node.

What combination of privileges and capabilities is most likely to have led to this privilege escalation?

AThere is no combination of privileges and capabilities that permits this.

BhostPID and SYS_PTRACE

ChostPath and AUDIT_WRITE

DhostNetwork and NET_RAW

Show Suggested Answer

Suggested Answer: A

by Cammy at Apr 11, 2026, 07:41 PM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

1 day ago

B) hostPID and SYS_PTRACE seems like the right combo.

upvoted 0 times

...

15 days ago

I feel like A could be a trick option, but I can't recall any specific combinations that would allow such permissions.

upvoted 0 times

...

20 days ago

I practiced a question similar to this, and I think hostPath is more about file access, so I doubt C is correct.

upvoted 0 times

...

25 days ago

I’m not entirely sure, but I think SYS_PTRACE is related to debugging processes, so maybe B is the right answer?

upvoted 0 times

...

1 month ago

I remember reading that hostPID allows containers to see and interact with processes on the host, which could lead to privilege escalation.

upvoted 0 times

...