5.5 Identify Indicators of Attack (IOAs), Rogue Containers and Drift CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security team discovers that a container has drifted from its original image by having a new binary added to its filesystem. The container is also making unusual outbound network connections. Which of the following is the most appropriate response?

   • ARemove the new binary from the container and continue running it.
   • BUpdate the container's image to the latest version and restart it.
   • CQuarantine the container and analyze the new binary and network connections.
   • DAllow the container to continue running and monitor its behavior.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team needs to detect container drift in their production environment. They have access to the original image digests and can deploy monitoring agents inside containers. Which technique would be most effective for detecting drift?

   • AChecking the container's CPU and memory usage over time
   • BReviewing Kubernetes audit logs for container creation events
   • CComparing the running container's filesystem hashes to the image's filesystem hashes
   • DMonitoring network connections for unusual destinations
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating a container that was started from a known good image. The analyst finds that a new binary has been added to the container's filesystem and a cron job has been installed. Which concept best describes this situation?

   • AIndicator of compromise (IOC)
   • BContainer drift
   • CRogue container
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the best definition of container drift?

   • AA container that is running with a different user than the one specified in the image.
   • BA container that has been moved from one host to another.
   • CA container that deviates from its original image or intended configuration while it is running.
   • DA container that has been updated to a newer version of its image.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Kubernetes administrator discovers a pod running in a namespace that is designated for production workloads, but the pod is not defined in any of the production deployment files. The pod's image is from a private registry that is not used by the organization. Which action should the administrator take?

   • ATerminate the pod and investigate how it was created
   • BMonitor the pod's resource usage for a few days
   • CChange the namespace of the pod to a non-production namespace
   • DAdd the pod to the deployment files to maintain consistency
   Reveal Solution Discussion Select an answer first