Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevOps engineer notices that a service account used by a CI/CD pipeline has suddenly started authenticating from an IP address in a different country and is pulling container images at an unusually high rate. The engineer wants to detect whether this is a compromised credential or a legitimate change. Which combination of signals should be correlated to make this determination?

   • ABlock the foreign IP at the network firewall and alert the security team to investigate the incident.
   • BImmediately revoke the service account and issue a new one, then review audit logs for any unauthorized actions.
   • CCompare the source IP geolocation with the expected CI/CD runner locations and check if the image pulls align with a scheduled release.
   • DCheck the service account's permissions and ensure it has the minimum required access to the container registry.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing network traffic logs and notices a series of connection attempts to multiple ports on the same internal IP address from a single source. The attempts occur in rapid succession. This pattern is characteristic of which type of threat?

   • AData exfiltration, where data is being transferred out of the network.
   • BPort scanning, which is often a precursor to a targeted attack.
   • CCommand-and-control communication, where a compromised host communicates with a remote server.
   • DDenial of service, where the host is overwhelmed with traffic.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating a potential data breach. They notice that a large amount of data has been transferred from an internal database to an external IP address over the network. Which detection mechanism would have been most effective in identifying this exfiltration?

   • ADatabase audit logging that records all queries.
   • BFile integrity monitoring that checks for changes to sensitive files.
   • CNetwork traffic analysis that monitors for large outbound transfers to unknown destinations.
   • DUser activity monitoring that tracks login times.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is investigating a potential application-level attack. They notice that a containerized application is making unexpected system calls and accessing files outside its expected scope. They want to determine if this is a code injection attack or a misconfiguration. Which approach should they take?

   • ARestart the application to see if the behavior persists.
   • BCompare the application's runtime behavior against a baseline of expected behavior to identify deviations that indicate an attack.
   • CReview the application's source code for vulnerabilities.
   • DCheck the container image for known vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which activity is an example of workload threat detection in a containerized environment?

   • AMonitoring container processes for unexpected or malicious commands
   • BReviewing firewall rules for the host network
   • CChecking badge access logs for the server room
   • DAnalyzing user login patterns
   Reveal Solution Discussion Select an answer first