Runtime Security in Container Orchestration GCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company wants to implement runtime security for its Kubernetes cluster using an open-source tool. They need to detect and alert on suspicious system calls, such as attempts to write to /etc/passwd. Which tool should they choose?

   • AKubernetes Audit Logging, which can be configured to detect file writes.
   • BFalco, which uses kernel-level system call monitoring and can be configured with custom rules.
   • CSysdig Secure, which is a commercial tool with advanced features.
   • DAqua Security, which is a commercial container security platform.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary function of Falco in a container orchestration environment?

   • ATo detect anomalous behavior in containers by monitoring system calls
   • BTo enforce network policies between pods
   • CTo scan container images for known vulnerabilities
   • DTo manage secrets and encrypt them in etcd
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps team runs a Kubernetes cluster with multiple namespaces. They need to detect a potential crypto-mining attack that involves unusual outbound network connections from pods to known mining pools. They already have Prometheus and Grafana for metrics. Which additional tool or configuration would best provide the required detection capability?

   • AEnable Kubernetes audit logging and ship the audit logs to a log aggregator, then create alerts for any pod-to-pod communication.
   • BConfigure Kubernetes NetworkPolicy to block all outbound traffic except to known internal services, and rely on the policy to prevent mining.
   • CUse Prometheus to scrape container network metrics and set an alert for any pod that exceeds a certain bandwidth threshold.
   • DDeploy Falco with rules that monitor outbound network connections and compare destination IPs against a threat intelligence feed of known mining pools.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to ensure that no container in their Kubernetes cluster runs with the 'privileged' flag. They have a policy-as-code tool that can integrate with Kubernetes. Which integration point should they use to enforce this policy?

   • AKubernetes RBAC to deny users the permission to create privileged pods.
   • BKubernetes Admission Controller (e.g., OPA/Gatekeeper) to validate pod specs and reject privileged pods.
   • CKubernetes Audit Logging to detect when a privileged pod is created.
   • DFalco runtime policy to detect privileged containers and alert.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevOps team uses Kubernetes with a policy engine to enforce runtime security. They want to prevent any container from running with the `--privileged` flag, and they also want to block the use of host network namespaces. Which Kubernetes-native mechanism should they use to enforce these restrictions at runtime?

   • APod Security Admission (PSA) with the restricted policy
   • BNetworkPolicy with a deny-all ingress rule
   • CResourceQuota with a limit on CPU and memory
   • DRuntimeClass with a custom handler that disables privileges
   Reveal Solution Discussion Select an answer first