5.5 Identify Indicators of Attack (IOAs), Rogue Containers and Drift CCCS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is investigating a container that has been flagged for suspicious behavior. The container is running a process that is attempting to read the host's /etc/shadow file, and the container has been modified from its original image. Which combination of concepts is most relevant to this situation?

   • AIOA and container drift
   • BRogue container and IOC
   • CContainer drift and rogue container
   • DIOA and rogue container
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is investigating a suspected rogue container in a Kubernetes cluster. The container is running, but it was not detected at creation time because the cluster's audit logging was not enabled. The team has access to runtime monitoring that can see process and network activity. Which signal would most strongly indicate that the container is rogue?

   • AThe container's image is from a public registry
   • BThe container has a high memory usage compared to other containers
   • CThe container is running a crypto-mining process and communicating with a mining pool
   • DThe container has been running for more than 24 hours
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a common technique for detecting container drift?

   • AComparing the runtime state of the container to the image baseline.
   • BReviewing the container's resource usage for anomalies.
   • CMonitoring the container's network traffic for unusual connections.
   • DScanning the container image for known vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is triaging an alert from a runtime protection tool. The alert shows a container that was not in the deployment manifest, and it is attempting to mount the host's /etc directory. Which response action should the analyst take first?

   • ACheck the container's resource usage to confirm it is malicious
   • BUpdate the deployment manifest to include the container
   • CIsolate the container by stopping it and blocking its network access
   • DRun a vulnerability scan on the container's image
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a common Indicator of Attack (IOA) in a containerized environment?

   • AA container that has been running for more than 24 hours without restarting.
   • BA process inside a container making an unexpected outbound network connection to a known command-and-control server.
   • CA container image that has been scanned and found to have no vulnerabilities.
   • DA container running with a read-only root filesystem.
   Reveal Solution Discussion Select an answer first