Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing Kubernetes audit logs and notices that a user 'john.doe' has been attempting to list secrets in the 'production' namespace. The user's role is 'developer' and they have no legitimate need to access secrets. The attempts are happening every few minutes. What is the most likely threat this behavior indicates?

   • AA misconfigured RBAC policy, where 'john.doe' has been accidentally granted access to secrets.
   • BA normal troubleshooting activity, where 'john.doe' is trying to debug an application issue.
   • CA data tampering attempt, where 'john.doe' is trying to modify the secrets.
   • DA compromised credential, where an attacker has stolen 'john.doe's' credentials and is trying to access sensitive data.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a primary method for detecting threats to the physical hosts that run Kubernetes worker nodes?

   • AAnalyzing network flow logs from the cluster's service mesh.
   • BMonitoring the kube-apiserver audit logs for suspicious API calls.
   • CReviewing container image vulnerability scans for known CVEs.
   • DUsing a host-based intrusion detection system (HIDS) that monitors system calls and file integrity on the node.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common method for detecting malicious activity within a containerized application?

   • AChecking the container image for known vulnerabilities before deployment.
   • BAnalyzing network flow logs for unusual connections to external IPs.
   • CMonitoring the application's runtime behavior, such as unexpected file writes or process execution.
   • DReviewing the Kubernetes audit logs for failed API requests.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a user and identity threat in a Kubernetes cluster?

   • AA user's service account token is leaked and used to create unauthorized pods.
   • BA node's BIOS firmware has been modified.
   • CA container image contains a known vulnerability.
   • DA pod attempts to access a service it is not allowed to reach.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a primary tool for detecting network threats in a Kubernetes cluster?

   • ACilium
   • BFalco
   • Ckube-bench
   • DWireshark
   Reveal Solution Discussion Select an answer first