Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which Kubernetes log source would you examine to detect an attacker creating a new Pod with a privileged container?

   • Akubelet logs
   • BContainer stdout logs
   • Cetcd logs
   • DAPI server audit logs
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensics team needs to collect logs from a Kubernetes cluster where applications write logs to stdout, but the team also needs to capture logs from a legacy application that writes only to a file inside its container. The cluster does not have a node-level logging agent deployed. Which approach ensures both log sources are collected without modifying the application?

   • AConfigure the legacy application to write logs to a network socket instead of a file
   • BDeploy a node-level agent such as Fluentd as a DaemonSet to collect container stdout logs and also tail the legacy application's log file from the host filesystem
   • CUse kubectl exec to manually copy the legacy log file from the container after each incident
   • DAdd a sidecar container that tails the legacy application's log file and writes it to stdout, then rely on the node-level agent to collect all stdout logs
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Kubernetes cluster uses a centralized logging solution that collects logs from all namespaces. The security team wants to ensure that logs from the kube-system namespace are retained for a longer period than other namespaces due to compliance requirements. Which approach should they take?

   • AConfigure the logging agent to add a label to logs from kube-system and set a separate retention policy in the log store
   • BUse a separate logging pipeline for kube-system logs
   • CDisable log rotation for kube-system pods
   • DStore all logs in the same index and rely on the log store's default retention
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst is reviewing Kubernetes audit logs and notices a series of API calls from a single service account that suddenly begins creating pods with hostPID: true and mounting the host filesystem. The account had no prior history of creating pods. Which log-driven indicator best supports a hypothesis of compromised credentials rather than a misconfigured application?

   • AA steady, predictable pattern of pod creation requests from the same service account every 5 minutes
   • BA single pod creation request that includes a standard nginx container image
   • CRepeated failed login attempts to the Kubernetes API server from an unknown IP address
   • DA sudden burst of create pod requests with privileged securityContext settings from an account that previously only read configmaps
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a common Kubernetes attack vector that exploits overly permissive Role-Based Access Control (RBAC) permissions?

   • AContainer image vulnerability exploitation
   • BDNS spoofing within the cluster
   • CPrivilege escalation via excessive API permissions
   • DDenial-of-service via resource exhaustion
   Reveal Solution Discussion Select an answer first