Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A cluster administrator notices that a pod is running with 'privileged: true' and has a hostPath mount to '/'. The pod's image is a standard 'nginx' image. The pod was created by a user who has 'cluster-admin' privileges. What is the most likely threat this configuration indicates?

   • AA network attack, where the pod is trying to scan the host's network.
   • BA data exfiltration attempt, where the pod is trying to read sensitive files from the host.
   • CA container escape, where the pod has been configured to allow an attacker to break out of the container and access the host.
   • DA misconfiguration, where the developer accidentally set the 'privileged' flag.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A cluster administrator is investigating a network anomaly. They notice that a pod is making connections to an internal service on a port that is not open. The pod's legitimate function is to communicate with the service on a different port. The connections are failing, but they are happening repeatedly. What is the most likely threat this behavior indicates?

   • AA network scan, where an attacker has compromised the pod and is probing the internal network for open ports.
   • BA data exfiltration attempt, where the pod is trying to send data to the service.
   • CA normal operation, as the pod may be retrying a failed connection.
   • DA misconfigured application, where the pod is trying to connect to the wrong port.
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   Which of the following is a common method for detecting compromised user credentials in a Kubernetes cluster?

   • AUsing a host-based intrusion detection system to monitor system calls.
   • BMonitoring network traffic for large outbound data transfers.
   • CScanning container images for known vulnerabilities.
   • DMonitoring API audit logs for unusual patterns, such as a user making requests from an unexpected IP address.
   Reveal Solution Discussion Select an answer first