Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of a network threat within a Kubernetes cluster?

   • AA pod attempts to communicate with a service that it is not allowed to access according to NetworkPolicies.
   • BA user with a leaked service account token creates a new pod.
   • CA container image contains a known vulnerability in a library.
   • DA node's BIOS firmware has been modified.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common method for detecting data exfiltration from a Kubernetes workload?

   • AChecking the kube-apiserver audit logs for failed authentication attempts.
   • BMonitoring network traffic for large outbound data transfers to unexpected destinations.
   • CUsing a host-based intrusion detection system to monitor system calls.
   • DReviewing the container image for known vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a common method for detecting privilege escalation within a Kubernetes workload?

   • AChecking the kube-apiserver audit logs for failed authentication attempts.
   • BMonitoring network traffic for unusual connections.
   • CReviewing the container image for known vulnerabilities.
   • DMonitoring system calls and process behavior for attempts to gain elevated privileges.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A cluster administrator notices that one of the worker nodes has a significantly higher load average than the others, and the 'kubelet' process is consuming an unusual amount of CPU. Upon investigation, they find a process named 'kdevtmpfsi' running on the host that is not a known Kubernetes component. What is the most appropriate immediate action?

   • ARestart the kubelet service to see if the issue resolves itself.
   • BImmediately terminate the suspicious process and isolate the node from the cluster.
   • CCordon the node and drain all pods to a different node before investigating further.
   • DIgnore the process, as it may be a legitimate kernel thread or system daemon.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing network flow logs and notices that a database pod, which is configured to only accept connections from a specific application pod, has been receiving traffic from a new, unknown pod in the same namespace. The unknown pod has no corresponding Deployment or ReplicaSet. What is the most likely explanation for this anomaly?

   • AThe database pod has been compromised and is connecting to the unknown pod to send data.
   • BThe network policy is misconfigured and is allowing all traffic to the database.
   • CA developer has manually created a pod for testing purposes and forgot to clean it up.
   • DAn attacker has created a malicious pod to directly access the database and exfiltrate data.
   Reveal Solution Discussion Select an answer first