5.5 Identify Indicators of Attack (IOAs), Rogue Containers and Drift CCCS Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   Which of the following is a common method for detecting a rogue container?

   • AMonitoring the container's CPU usage to ensure it stays below 50%.
   • BChecking the container's environment variables for sensitive data.
   • CReviewing the container's logs for error messages.
   • DMonitoring for unexpected image pulls from a container registry.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of an Indicator of Attack (IOA) rather than an Indicator of Compromise (IOC)?

   • AA process attempting to escalate privileges shortly after a container starts.
   • BA modified configuration file that matches a known vulnerability signature.
   • CA known malicious file hash found on a container filesystem.
   • DA suspicious IP address listed in the container's network logs.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a signal that could indicate the presence of a rogue container?

   • AA sudden and unexplained increase in network traffic from a container that was not part of the original deployment.
   • BA container that has been assigned a static IP address.
   • CA container that has been running for a long time without any restarts.
   • DA container that has a low number of running processes.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a container that has been flagged for drift. The container's image is immutable, but the analyst finds that a new file has been added to the container's filesystem. The analyst also notices that the container's process list includes a process that is not in the image's process list. Which conclusion is most accurate?

   • AThe container is compromised because it has a new process
   • BThe container is a rogue container because it has new files and processes
   • CThe container has drifted from its original image, as evidenced by the new file and process
   • DThe container is running an IOA because of the new process
   Reveal Solution Discussion Select an answer first