Runtime Security in Container Orchestration GCSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cloud security architect is explaining runtime security to a development team. The team wants to understand why runtime security is important in container orchestration beyond image scanning. Which statement best describes the role of runtime security?

   • AIt only monitors the Kubernetes control plane, not the containers themselves.
   • BIt replaces the need for image scanning by providing continuous vulnerability assessment.
   • CIt protects running workloads by detecting and responding to threats that occur after containers are deployed.
   • DIt is primarily used to secure the CI/CD pipeline before deployment.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary role of audit logging in Kubernetes for runtime security?

   • ATo provide a record of API requests that can be analyzed for suspicious activity
   • BTo automatically block malicious pods from running
   • CTo monitor container system calls in real time
   • DTo encrypt data at rest in etcd
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In an orchestrated environment, what is the purpose of the 'eradication' phase in incident response?

   • ATo remove the root cause of the incident from the environment
   • BTo collect forensic evidence from the compromised container
   • CTo restore the service to normal operation
   • DTo isolate the affected pod from the network
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   During a security incident, a Kubernetes cluster has a compromised pod that is executing cryptocurrency miners. The pod is part of a Deployment with replicas. The security team needs to contain the threat while preserving forensic evidence and minimizing service disruption. Which sequence of actions should they take?

   • AScale the Deployment to zero, snapshot the pod's container filesystem, and then delete the pod.
   • BCordon the node, drain it, and then delete the Deployment.
   • CImmediately delete the pod and then run `kubectl logs` on the terminated pod.
   • DApply a NetworkPolicy to isolate the pod, capture a memory dump from the container, and then delete the pod with `--force --grace-period=0`.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security incident has been detected in a Kubernetes cluster: a container is running a reverse shell to an external server. The incident response team needs to contain the threat while preserving evidence for forensic analysis. The cluster uses a service mesh with mTLS and NetworkPolicies. Which action should be taken FIRST?

   • ATake a snapshot of the container filesystem before taking any other action.
   • BDelete the pod immediately to stop the reverse shell.
   • CUse `kubectl exec` to kill the reverse shell process inside the container.
   • DApply a NetworkPolicy that denies all egress traffic from the pod's namespace.
   Reveal Solution Discussion Select an answer first