5.5 Identify Indicators of Attack (IOAs), Rogue Containers and Drift CCCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevOps team uses a containerized application that periodically fetches configuration from an internal service. The runtime security tool flags a container that is making repeated outbound connections to a public IP on port 4444, and the process tree shows a child process named 'nc' spawned from the main application. Which IOA is most clearly indicated?

   • ARogue container creation
   • BContainer drift
   • CUnusual network connection
   • DPrivilege escalation attempt
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team wants to implement drift detection for their containerized applications. They have a policy that requires detecting any changes to critical files, such as binaries and configuration files, but they want to minimize false positives from ephemeral files like logs. Which approach best meets this requirement?

   • AUse file integrity monitoring that compares hashes of critical files to the image baseline, excluding known ephemeral paths
   • BMonitor all filesystem changes and alert on any modification
   • CCompare the container's running processes to the image's process list
   • DUse network monitoring to detect unusual outbound connections
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security engineer notices a container running in a production Kubernetes cluster that is not listed in the deployment manifests. The container's image is from a public registry, and it has a high CPU usage pattern. The engineer needs to determine if this is a rogue container. Which combination of signals best confirms this?

   • AThe container was created recently and has a small image size.
   • BThe container is running a shell process and has network access.
   • CThe container is not in the deployment manifests and was pulled from a public registry.
   • DThe container has high CPU usage and is running in production.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following behaviors is a typical Indicator of Attack (IOA) related to privilege escalation?

   • AA container that has a high CPU usage for a short period.
   • BA process that attempts to change its user ID to root after the container has started.
   • CA container that is restarted multiple times in a short period.
   • DA container that is running with the 'latest' image tag.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following scenarios best describes a rogue container?

   • AA container that is using more memory than the limit specified in its deployment manifest.
   • BA container that has been configured with a non-root user instead of the default root user.
   • CA container that was created by an attacker who exploited a vulnerability in the Kubernetes API server.
   • DA container that is running a slightly older version of the application than the latest release.
   Reveal Solution Discussion Select an answer first