Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company operates a Kubernetes cluster in a data center that is shared with other tenants. They are concerned about hardware tampering by other tenants who have physical access to the servers. They want to detect if a server's hardware has been modified. Which detection method is most appropriate given the shared environment?

   • AConduct regular physical inspections of the servers.
   • BMonitor the server's network traffic for unusual activity.
   • CInstall physical tamper-evident seals on the servers.
   • DImplement a hardware root of trust and use remote attestation to verify the integrity of the server's firmware and hardware.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common indicator of malware execution within a container?

   • AA container having a predictable network connection to a database
   • BA container restarting due to a configuration error
   • CA process spawning a shell or executing unusual system commands
   • DA container using a small amount of CPU
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a common indicator of command-and-control (C2) communication in network traffic?

   • AA decrease in overall network bandwidth usage
   • BA single large file download from a legitimate software vendor
   • CAn increase in email traffic to internal users
   • DRegular, periodic connections to a known malicious domain
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which method is commonly used to detect unauthorized physical access to a data center?

   • AScanning container images for vulnerabilities
   • BAnalyzing network traffic for unusual patterns
   • CMonitoring badge access logs and reviewing surveillance camera footage
   • DReviewing application logs for SQL injection attempts
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security engineer is investigating a compromised container in a Kubernetes cluster. The container is running a web server and has been observed spawning a shell process and making outbound connections. Which detection tool would have been most effective in identifying this behavior?

   • AA Kubernetes network policy that restricts egress traffic from the container.
   • BA container image scanner that checks for known vulnerabilities.
   • CA log aggregator that collects container logs and stores them for analysis.
   • DA runtime security agent that monitors process execution and network connections within the container.
   Reveal Solution Discussion Select an answer first