Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is concerned about hardware tampering in its data center. They want to detect if a server's firmware has been modified without authorization. Which detection method should they implement?

   • AUse a hardware root of trust and measure the firmware integrity during boot.
   • BReview the server's system logs for error messages.
   • CInstall a security camera near the server rack.
   • DMonitor the server's network traffic for unusual connections.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices a sudden spike in outbound traffic from a Kubernetes worker node to an external IP address on port 443. The traffic pattern shows regular intervals and the destination is not a known update server. Which action should the analyst take first to determine if this is data exfiltration?

   • AInspect the network flow logs to identify which pod or process is generating the traffic and correlate with any recent container deployments.
   • BCheck the container image for known vulnerabilities using a scanner.
   • CBlock the external IP address at the network firewall to stop the traffic immediately.
   • DReview the Kubernetes audit logs for any changes to network policies or service accounts.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is investigating a potential insider threat. They notice that a user has been logging in from a new location and has been accessing sensitive data that is not part of their job role. The user has valid credentials. Which detection method would best identify this as a threat?

   • AUse user and entity behavior analytics (UEBA) to detect deviations from the user's normal behavior, such as new locations and access to sensitive data.
   • BConduct a background check on the user.
   • CReview the user's email for any suspicious communications.
   • DDisable the user's account until the investigation is complete.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement best describes the role of threat detection in securing an organization's assets?

   • AIt is primarily focused on physical security controls such as locks and guards
   • BIt is a continuous process that provides visibility into potential security incidents
   • CIt is only necessary for organizations that have experienced a breach
   • DIt is a one-time assessment performed during system deployment
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company hosts its Kubernetes cluster in a colocation data center. The security team wants to detect if someone gains unauthorized physical access to the servers hosting the cluster. Which method should they use?

   • AMonitor the Kubernetes API server logs for unusual authentication attempts.
   • BUse a vulnerability scanner to check for open ports on the servers.
   • CInstall motion sensors and cameras in the server room and review access logs for the data center.
   • DImplement strong password policies for the server console.
   Reveal Solution Discussion Select an answer first