3.6 Describe Application and Workload Security Concepts Including eBPF 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a key advantage of using eBPF for observability compared to traditional kernel modules?

   • AeBPF programs can modify the kernel source code directly
   • BeBPF programs are written in high-level languages like Python
   • CeBPF programs are verified and sandboxed, reducing the risk of crashing the kernel
   • DeBPF programs do not require any privileges to load
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which security practice is most directly concerned with preventing common web application vulnerabilities such as SQL injection and cross-site scripting?

   • APatch management
   • BNetwork segmentation
   • CInput validation
   • DThreat modeling
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company runs a multi-tier application in a cloud environment. The security team wants to ensure that if one workload is compromised, the attacker cannot easily move laterally to other tiers. They also need to maintain visibility into network traffic between workloads. Which two controls should they implement together?

   • AWorkload isolation using separate virtual networks and no logging.
   • BA single network security group applied to all workloads and a central firewall.
   • CEncryption of all data at rest and in transit.
   • DMicro-segmentation with security groups and flow logs for traffic monitoring.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst needs to monitor container activity in a Kubernetes cluster to detect unusual system calls or network connections. The solution must not require changes to the container images or the applications running inside them. Which technology is best suited for this task?

   • AA network policy that restricts all traffic between pods.
   • BA vulnerability scanner that scans container images for known vulnerabilities.
   • CA sidecar container that runs alongside each application and logs its activity.
   • DeBPF-based tools that run on the host and observe container processes.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is eBPF (Extended Berkeley Packet Filter) primarily used for in modern systems?

   • AEncrypting all network traffic on a host
   • BReplacing the operating system kernel entirely
   • CProviding a virtual machine for running user-space applications
   • DRunning sandboxed programs in the kernel for observability and security
   Reveal Solution Discussion Select an answer first