Runtime Security in Container Orchestration GCSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During a security incident, a container in a Kubernetes pod is executing a reverse shell to an external IP. The incident response team needs to stop the malicious activity while preserving evidence for forensic analysis. The pod is running a stateless application. Which response action should they take?

   • AUse 'kubectl exec' to enter the container and kill the shell process, then capture a memory dump of the container.
   • BImmediately delete the pod using 'kubectl delete pod' to stop the reverse shell.
   • CIsolate the pod by applying a NetworkPolicy that blocks all egress traffic, then capture the container's memory and filesystem using forensic tools before terminating the pod.
   • DSnapshot the container's filesystem and memory using a tool like 'docker commit' or 'crictl' before terminating the container, then delete the pod.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is investigating a potential runtime threat in a Kubernetes cluster. They observe that a container is repeatedly attempting to access the Kubernetes API server from within the pod. The team wants to determine if this is malicious behavior or a legitimate application function. Which approach would provide the most useful information?

   • AReview the Kubernetes audit logs for the pod's service account and compare the API requests to the application's expected behavior.
   • BCheck the container image's Dockerfile to see if it includes API client libraries.
   • CImmediately block the pod's egress traffic with a NetworkPolicy.
   • DUse `kubectl exec` to run a shell in the container and manually inspect the processes.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security incident has been contained in a Kubernetes cluster. The compromised pod has been isolated, and the attacker's access has been revoked. The incident response team now needs to eradicate the threat and recover the cluster to a known good state. Which action should they take?

   • ARestart the kubelet on the affected node to clear any malicious processes.
   • BReapply the original Kubernetes manifests to restore the pod.
   • CRun a vulnerability scan on the container image to ensure it is clean.
   • DDelete the compromised pod and all associated resources, then redeploy the application from a trusted image.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Kubernetes cluster runs a mix of trusted internal workloads and untrusted customer-facing workloads. The security team wants to enforce a runtime policy that blocks untrusted workloads from using 'exec' to enter a running container, but they do not want to affect trusted workloads. Which approach is the most effective?

   • AEnable Kubernetes audit logging to detect 'exec' events and alert the security team.
   • BUse a Kubernetes admission controller to deny 'exec' requests for pods in the untrusted namespace.
   • CUse Kubernetes RBAC to deny 'exec' permissions to users who have access to untrusted namespaces.
   • DDeploy Falco with a rule that detects 'exec' events and kills the container for all pods.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team wants to enforce a policy that prevents any container from running with the 'hostPID' namespace, which could allow a container to see processes on the host. They also want to detect any attempt to use 'hostPID' at runtime. Which combination of controls should they implement?

   • AUse an admission controller to reject pods with 'hostPID: true' and deploy Falco to detect runtime attempts to access host processes.
   • BUse RBAC to deny users the permission to create pods with 'hostPID'.
   • CUse only Kubernetes audit logging to detect pods with 'hostPID: true'.
   • DUse only Falco to detect and kill containers that use 'hostPID'.
   Reveal Solution Discussion Select an answer first