Runtime Security in Container Orchestration GCSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is integrating runtime security with a Kubernetes cluster that uses a service mesh. They want to enforce a policy that blocks a specific container from making outbound connections to a known malicious IP address. The policy should be applied at the network layer and should not require changes to the container image. Which approach should they use?

   • AUse a NetworkPolicy that denies egress traffic to the malicious IP address.
   • BUse a Falco rule that kills the process when it attempts to connect to the malicious IP.
   • CUse a mutating admission webhook to add an iptables rule to the container.
   • DUse a service mesh policy to block the connection at the application layer.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of monitoring container activity for anomalies in an orchestration platform?

   • ATo ensure containers are using the latest image tags
   • BTo automatically scale container replicas based on CPU usage
   • CTo identify deviations from expected behavior that may indicate a security incident
   • DTo collect billing information for resource usage
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which Kubernetes native mechanism can be used to enforce runtime security policies that restrict container capabilities?

   • APod Security Standards (PSS) / Pod Security Admission (PSA)
   • BNetworkPolicy resources
   • CResourceQuota objects
   • DConfigMap resources
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team wants to implement runtime security for containers running in a Kubernetes cluster. They need a tool that can enforce policies based on container behavior, such as blocking the execution of certain binaries and preventing writes to sensitive directories. Which tool should they choose?

   • ASysdig Secure
   • BPrometheus
   • CKubernetes Secrets
   • DKube-bench
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst wants to detect if a container is attempting to mount the host's Docker socket, which could allow the container to control the host's Docker daemon. Which tool and configuration would best detect this?

   • AUse Sysdig Secure's Image Scanning to check if the container image includes a Docker client.
   • BEnable Kubernetes audit logging to detect pods that mount /var/run/docker.sock.
   • CUse Prometheus to monitor container mounts and alert on any mount of /var/run/docker.sock.
   • DDeploy Falco with a rule that triggers on 'open' or 'connect' syscalls to /var/run/docker.sock.
   Reveal Solution Discussion Select an answer first