Containers and Orchestration GCTD Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A Kubernetes administrator wants to detect unauthorized changes to cluster roles and role bindings. Which monitoring data should be collected and analyzed?

   • AAPI server audit logs that record create, update, and delete events for roles and role bindings.
   • Betcd snapshots that show the current state of the cluster.
   • CContainer runtime logs that show process execution.
   • Dkubelet logs that show pod scheduling decisions.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which forensic artifact is most important to preserve from a compromised container?

   • AThe host's uptime
   • BContainer logs and metadata
   • CThe container's image name
   • DThe container's IP address
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security operations center (SOC) wants to centralize logs from multiple Kubernetes clusters, including API server audit logs, kubelet logs, and container stdout/stderr. The solution must support correlation across clusters and provide near-real-time alerting. Which approach best meets these requirements?

   • ADeploy a centralized log aggregation platform (e.g., Elasticsearch, Splunk) and configure Fluentd or Vector agents on each cluster to forward logs.
   • BStore logs locally on each node and have analysts SSH into nodes to review them during investigations.
   • CEnable Kubernetes audit logs and send them directly to a SIEM via email alerts.
   • DUse a cloud provider's object storage to archive logs without indexing or search capabilities.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security auditor requires that all container images used in production have a signed provenance and are free of critical vulnerabilities. The team needs to enforce this at deployment time. Which combination of tools should they implement?

   • AImage signing with cosign and an admission controller that verifies signatures and vulnerability scan results
   • BRegistry webhooks that block image pushes
   • CRuntime monitoring of container behavior
   • DManual review of image manifests before deployment
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security team is investigating a possible data exfiltration from a containerized application. The application mounts a persistent volume that contains sensitive files. Which monitoring approach would best detect unauthorized reads from the volume?

   • ACapture network traffic to detect large outbound transfers.
   • BReview Kubernetes audit logs for volume mount operations.
   • CEnable file integrity monitoring on the volume and alert on access to sensitive files.
   • DMonitor volume capacity metrics to detect sudden increases in disk usage.
   Reveal Solution Discussion Select an answer first