Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a threat that targets the physical infrastructure layer of a Kubernetes deployment?

   • AA user with excessive permissions creates a privileged pod that mounts the host filesystem.
   • BAn attacker with physical access to a data center inserts a hardware keylogger to capture credentials from an admin console.
   • CAn attacker exploits a vulnerability in a container runtime to escape a pod and gain access to the host.
   • DA malicious pod performs a network scan to discover other services in the cluster.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a threat that targets the data plane of a Kubernetes cluster?

   • AA user with read-only permissions attempts to modify a deployment, but the request is denied by RBAC.
   • BAn attacker exploits a vulnerability in the kube-apiserver to gain unauthorized administrative access.
   • CA malicious pod attempts to access sensitive data stored in a mounted volume without proper authorization.
   • DAn attacker performs a denial-of-service attack against the etcd cluster, causing the API server to become unresponsive.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team is using Falco to monitor container activity. They receive an alert that a process inside a container is trying to execute a binary from a mounted hostPath directory. The container's legitimate application is a Python web server. What is the most likely threat this alert indicates?

   • AA normal operation, as the Python web server may need to execute helper scripts from the host.
   • BA network attack, where the container is trying to scan the host's network.
   • CA data exfiltration attempt, where the container is trying to read sensitive files from the host.
   • DA code injection attack, where the attacker has modified the application to execute arbitrary binaries from the host.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A cluster administrator is investigating a potential data breach. They notice that a pod in the 'finance' namespace has been making large outbound data transfers to an IP address in a foreign country. The pod's legitimate function is to process internal payroll data and should not have any external network access. What is the most likely threat this behavior indicates?

   • AA legitimate business need, as the company may have a partner in that country.
   • BA network misconfiguration, where the pod's network policy is incorrectly allowing external access.
   • CData exfiltration, where an attacker has compromised the pod and is sending sensitive financial data to an external server.
   • DA denial-of-service attack, where the pod is being used to flood an external server with traffic.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is reviewing audit logs and notices that a service account 'ci-bot' has been creating and deleting pods in the 'staging' namespace at a very high frequency. The 'ci-bot' is supposed to only trigger deployments during business hours. The activity is happening at 2:00 AM. What is the most likely threat this behavior indicates?

   • AA normal operation, as the CI/CD pipeline may be running a large batch of tests.
   • BA misconfigured CI/CD pipeline, where the pipeline is running at the wrong time.
   • CA compromised service account, where an attacker has stolen the 'ci-bot' credentials and is using them to run malicious workloads.
   • DA network attack, where the 'ci-bot' is being used to scan the cluster's network.
   Reveal Solution Discussion Select an answer first