Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer is monitoring a Kubernetes cluster and notices that a container is making DNS queries to a domain that is known to be malicious. The container is not supposed to have internet access. Which detection method would have identified this threat?

   • AContainer image scanning for known vulnerabilities.
   • BKubernetes audit logging that records API requests.
   • CNetwork policy monitoring that logs DNS queries and flags connections to known malicious domains.
   • DRuntime security monitoring that checks for file system changes.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common method to detect privilege escalation by a user?

   • AMonitoring for changes in user permissions or group memberships
   • BChecking the physical security of the data center
   • CScanning container images for vulnerabilities
   • DReviewing network traffic for port scans
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a web application in Kubernetes that processes sensitive customer data. The security team wants to detect if an attacker is attempting to inject malicious code into the application through user input. Which approach should they implement to detect this threat?

   • AConfigure a web application firewall (WAF) to block common injection patterns.
   • BScan the application's dependencies for known vulnerabilities on a regular basis.
   • CImplement network policies to restrict traffic to the application pod.
   • DEnable runtime security monitoring that inspects application behavior for anomalies such as unexpected system calls or file access.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a common method to detect runtime anomalies in an application?

   • AReviewing physical access logs to the server room
   • BChecking the integrity of backup tapes
   • CScanning the network for open ports
   • DMonitoring application performance metrics and error logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is investigating a potential insider threat. They notice that a user has been logging in from a new device and has been attempting to access applications they have never used before. Which detection method would best identify this as a suspicious behavior?

   • AConducting a background check on the user.
   • BDisabling the user's account until the investigation is complete.
   • CReviewing the user's email for any suspicious communications.
   • DUser and entity behavior analytics (UEBA) that establishes a baseline of normal behavior and flags deviations.
   Reveal Solution Discussion Select an answer first