Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A security analyst is investigating a suspected data exfiltration from a Kubernetes cluster. The analyst needs to determine what commands were executed inside a specific container. Which log source should the analyst examine?

   • AThe kubelet logs on the node where the container ran
   • BThe container runtime's audit logs (e.g., Docker or containerd audit logs)
   • CThe Kubernetes audit logs for the pod
   • DThe container's stdout logs
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A responder is analyzing kube-apiserver audit logs and sees a series of requests from a user account that include 'get', 'list', and 'watch' verbs on the 'secrets' resource across multiple namespaces. The user's role is defined as 'view' which should only allow read access to non-sensitive resources. What does this log pattern most likely indicate?

   • AThe user is attempting to brute-force the API server with invalid credentials
   • BThe user is performing a legitimate backup of secrets
   • CThe user is using a kubectl plugin that caches secret data locally
   • DThe user has been granted a broader role than intended, or the 'view' role has been misconfigured to include secrets
   Reveal Solution Discussion Select an answer first