# Which Pod Security Standards level requires pods to run as non-root, drop ALL capabilities, and use a seccomp profile?

Kubernetes, Hard (Expert), Security. https://k8wiz.com/uquiz/which-pod-security-standards-level-requires-pods-to-run-as-non-root-drop-all-capabilities-and-use-a-seccomp-profile

- A. baseline
- B. restricted
- C. privileged
- D. hardened

**Answer:** restricted

**Explanation:** Pod Security Admission has three levels. privileged allows everything. baseline blocks known privilege escalations such as hostPath volumes and privileged containers. restricted also requires runAsNonRoot, allowPrivilegeEscalation: false, dropping ALL capabilities (NET_BIND_SERVICE may be added back) and a RuntimeDefault or Localhost seccomp profile. You turn it on with namespace labels such as pod-security.kubernetes.io/enforce: restricted.