3.6 Describe Application and Workload Security Concepts Including eBPF 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A cloud provider offers a managed Kubernetes service. The security team wants to implement runtime security monitoring for all pods, but they have a constraint: they cannot modify the node operating system or install kernel modules. Which approach should they take?

   • AEnable audit logging on the Kubernetes API server and analyze those logs.
   • BUse a network policy to restrict all pod-to-pod traffic and rely on that for security.
   • CDeploy a privileged sidecar container in every pod that monitors system calls.
   • DUse a managed eBPF-based security solution that runs as a DaemonSet on the nodes.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations team needs to monitor system calls and network activity on Linux hosts without modifying the application code or requiring the applications to be restarted. They want a solution that provides deep visibility with low overhead. Which technology should they use?

   • AA network tap that mirrors all traffic to a separate analysis appliance.
   • BA traditional host-based intrusion detection system (HIDS) that relies on log analysis.
   • CA web application firewall (WAF) placed in front of the applications.
   • DeBPF (Extended Berkeley Packet Filter)
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is designing a zero-trust network for a hybrid cloud environment. They need to enforce access policies based on user identity and device posture, and also gain visibility into all traffic between workloads. Which combination of technologies is most aligned with zero-trust principles?

   • AIdentity-aware proxy and eBPF-based network observability.
   • BA web application firewall (WAF) and a security information and event management (SIEM) system.
   • CA traditional VPN and a network firewall with IP-based rules.
   • DA single sign-on (SSO) solution and a network access control (NAC) system.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to implement a solution that can automatically block a process if it attempts to write to a sensitive directory, such as /etc/shadow, on a Linux host. The solution should be policy-driven and operate in real time. Which approach should they use?

   • ADeploy a network firewall that blocks all traffic to the host.
   • BSet file permissions to read-only for all users except root.
   • CUse a host-based intrusion detection system (HIDS) that alerts on file changes.
   • DUse an eBPF-based security agent that monitors file write operations and enforces a deny policy.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to detect and block malicious behavior at runtime, such as a process attempting to execute a file from a temporary directory or making an unauthorized network connection. They need a solution that can enforce policy directly in the kernel with minimal latency. Which approach is most appropriate?

   • AConfigure the application to perform its own security checks before executing any file.
   • BUse a vulnerability scanner to periodically check for known vulnerabilities in the system.
   • CUse eBPF-based runtime security tools that hook into kernel events and enforce policies.
   • DDeploy a network intrusion detection system (NIDS) that inspects all traffic at the network perimeter.
   Reveal Solution Discussion Select an answer first