Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of threat detection in a comprehensive security strategy?

   • ATo prevent all attacks from occurring by blocking malicious traffic at the perimeter
   • BTo identify and alert on potential security incidents across various layers of the environment
   • CTo automatically remediate all security vulnerabilities without human intervention
   • DTo replace the need for security policies and access controls
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which user behavior is a common indicator of a potential insider threat?

   • AA user accessing only the resources required for their job
   • BA user accessing sensitive data outside of normal working hours
   • CA user logging in from the same workstation daily
   • DA user regularly changing their password
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security engineer is investigating a compromised container. The container was running a legitimate application, but it has been observed executing commands that are not part of the application's normal behavior. The engineer wants to determine if this is a malware infection or a misconfiguration. Which approach should they take?

   • ACheck the Kubernetes audit logs for any unauthorized API requests.
   • BReview the container image for known vulnerabilities.
   • CRestart the container to see if the behavior persists.
   • DCompare the container's process execution against a baseline of expected processes for that application.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has a multi-cluster Kubernetes environment. They have implemented threat detection tools, but the security team is overwhelmed by alerts. They want to prioritize alerts that indicate a real threat. Which approach should they take to improve the effectiveness of their threat detection?

   • ADisable detection tools that generate the most alerts to reduce noise.
   • BCorrelate alerts from different sources, such as network logs, user activity, and workload behavior, to identify patterns that indicate a real attack.
   • CFocus only on alerts related to network traffic, as they are the most critical.
   • DIncrease the sensitivity of all detection tools to catch more potential threats.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which activity is an example of application-level threat detection?

   • AReviewing firewall rules for open ports
   • BAnalyzing CPU usage on a database server
   • CChecking badge access logs for after-hours entry
   • DMonitoring application logs for SQL injection attempts
   Reveal Solution Discussion Select an answer first