Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a potential data breach. They find that a pod in the 'payment' namespace has been writing to a file in a mounted volume that is not part of its expected application behavior. The pod's application is a Java-based payment processor. The file is being written to a path that is also accessible by another pod in the same namespace. What is the most likely threat this behavior indicates?

   • AA code injection attack, where the attacker has modified the Java application to write malicious data.
   • BA normal operation, as the Java application may need to write temporary files.
   • CA network attack, where the pod is trying to exfiltrate data through the file system.
   • DData tampering, where an attacker has compromised the pod and is modifying sensitive data to commit fraud.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a workload threat in a Kubernetes cluster?

   • AA user with a leaked service account token creates a new pod.
   • BA pod attempts to access a service it is not allowed to reach.
   • CA container attempts to escape its runtime isolation and gain access to the host.
   • DA node's BIOS firmware has been modified.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a sign of a physical infrastructure threat on a Kubernetes node?

   • AA service account is making API calls at unusual hours.
   • BNetwork traffic to a pod is unusually high.
   • CThe node's BIOS firmware has been modified without authorization.
   • DA pod is repeatedly crashing due to an out-of-memory error.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is reviewing audit logs and finds that a pod running with the 'default' service account executed 'chmod 4755 /bin/sh' and then spawned a new shell process. The pod's container image is a standard 'ubuntu' image and the application inside is a simple web server. What is the most likely threat this activity represents?

   • AA network reconnaissance activity, where the attacker is probing for open ports on the host.
   • BA normal administrative task, as the web server may need to modify system files to function correctly.
   • CA privilege escalation attempt, where an attacker is trying to gain root-level capabilities on the container.
   • DA data tampering attempt, where the attacker is modifying system files to hide their tracks.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is investigating a potential data breach. They notice that a pod in the 'analytics' namespace has been reading a large number of files from a mounted volume that contains customer data. The pod's legitimate function is to process aggregated data, not raw customer data. What is the most likely threat this behavior indicates?

   • AData exfiltration, where an attacker has compromised the pod and is reading sensitive customer data to steal it.
   • BA code injection attack, where the attacker has modified the application to read sensitive data.
   • CA network attack, where the pod is trying to exfiltrate data through the file system.
   • DA normal operation, as the analytics application may need to read raw data for processing.
   Reveal Solution Discussion Select an answer first