Runtime Security in Container Orchestration GCSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step in responding to a runtime security incident in a Kubernetes cluster?

   • AIdentify and confirm the incident through monitoring and alerting
   • BEradicate the threat by deleting the compromised pod
   • CContain the incident to prevent further damage
   • DRecover the system by restoring from backups
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common runtime threat that specifically targets containerized environments?

   • APrivilege escalation via a container running with elevated capabilities
   • BPhishing attacks targeting users of the container registry
   • CDenial of service caused by a misconfigured load balancer
   • DSQL injection through a web application running inside a container
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst detects a container that is scanning the internal network from within a Kubernetes cluster. The container is part of a legitimate application but is behaving abnormally. The incident response team needs to stop the scanning while minimizing impact to the application. Which action should they take?

   • AUse 'kubectl exec' to enter the container and kill the scanning process.
   • BImmediately delete the pod running the container to stop the scanning.
   • CScale the deployment to zero replicas to stop the scanning.
   • DApply a Kubernetes NetworkPolicy that blocks all egress traffic from the pod, then investigate the container's behavior.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team is evaluating runtime security tools for a Kubernetes environment. They need a tool that can provide a detailed forensic record of container activity, including process execution, file access, and network connections, for post-incident analysis. Which tool is best suited for this requirement?

   • AKube-bench
   • BPrometheus
   • CKubernetes Dashboard
   • DSysdig
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst detects a container escape from a pod running in a Kubernetes cluster. The attacker has gained access to the worker node's host filesystem. The cluster runs critical production workloads. The incident response team must contain the threat while minimizing downtime. Which action should be taken FIRST?

   • ARevoke the service account tokens of the compromised pod and update the RBAC policies to deny access to the node.
   • BSnapshot the node's memory and disk for forensic analysis, then power off the node.
   • CImmediately delete the compromised pod and all pods on the same node to prevent lateral movement.
   • DCordon the node and drain it, then terminate the compromised pod and isolate the node from the network.
   Reveal Solution Discussion Select an answer first