Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of a data threat in a Kubernetes environment?

   • AA container attempts to execute a shell process.
   • BA node's BIOS firmware has been modified.
   • CA user with a leaked service account token creates a new pod.
   • DA pod attempts to read a Secret that it is not authorized to access.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A cluster administrator is investigating a potential host compromise. They notice that a worker node's kernel module list has changed and a new module named 'pwnmod' has been loaded. The node is running several pods, but none of them are known to load kernel modules. What is the most likely threat this behavior indicates?

   • AA normal operation, as the kernel may load modules for hardware support.
   • BA network misconfiguration, where the node's network policy is incorrectly allowing external traffic.
   • CA pod resource leak, where one of the pods is consuming more CPU than expected.
   • DA rootkit, where an attacker has gained root access to the host and loaded a malicious kernel module to hide their activities.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst notices that a developer's service account token was used to create a pod in the 'kube-system' namespace at 3:00 AM, a time when the developer is typically offline. The pod's image is 'nginx:latest' and it mounts the host's '/var/lib/kubelet' directory. Which combination of signals most strongly indicates a compromised credential rather than a legitimate administrative action?

   • AThe pod was created in a privileged namespace, the image is a common public image, and the action occurred outside normal working hours.
   • BThe pod uses a public image and does not specify resource limits, which is a common misconfiguration but not a sign of compromise.
   • CThe service account token was created recently and has not been rotated, indicating a possible configuration drift.
   • DThe pod was scheduled on a node with a taint that tolerates the deployment, showing the scheduler placed it correctly.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of an application-level threat in a containerized application?

   • AAn attacker exploits a SQL injection vulnerability in a web application running in a pod.
   • BA user with a leaked service account token creates a new pod.
   • CA container attempts to mount the host's /etc directory.
   • DAn attacker performs a port scan to discover open ports on a pod.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is monitoring node-level metrics and notices that a worker node's CPU usage is consistently at 100% and the network interface is sending a large amount of data to an external IP. The node is running several pods, but none of them are known to be CPU-intensive or have external network requirements. What is the most likely threat this behavior indicates?

   • AA network misconfiguration, where the node's network policy is incorrectly allowing external traffic.
   • BA host compromise, where an attacker has gained access to the node and is running a cryptocurrency miner or other malicious process.
   • CA pod resource leak, where one of the pods is consuming more CPU than expected.
   • DA normal operation, as the node may be handling a large batch job.
   Reveal Solution Discussion Select an answer first