A database administrator notices that a user account with read-only permissions has been querying a table containing credit card numbers at unusual hours. The queries return large result sets. Which detection mechanism would best identify this as a potential data exfiltration?

Implement data masking for the credit card numbers in the database.

Enable database audit logging that records all SELECT statements and correlate with user access patterns.

Restrict the user's permissions to remove access to the sensitive table.

Set up a network intrusion detection system (IDS) to monitor traffic to the database server.

A security analyst is investigating a potential data exfiltration. They notice that a user account has been downloading large amounts of data from an internal server and sending it to an external IP address. The user has legitimate access to the data. Which detection method would best identify this as a malicious activity?

Correlate the user's download activity with the external IP address and compare it to the user's normal behavior.

Disable the user's account immediately.

Block the external IP address to prevent further data transfer.

Review the user's login history for any anomalies.

A security team wants to detect if a containerized application is vulnerable to a known exploit in one of its dependencies. The application is already running in production. Which approach should they use to detect this threat?

Review the application's source code for insecure coding practices.

Check the Kubernetes audit logs for any unauthorized access to the application.

Monitor the application's runtime behavior for anomalies.

Run a vulnerability scanner against the container image to identify known vulnerabilities in dependencies.

Which activity is an example of data threat detection?

Reviewing firewall rules for open ports

Checking the physical security of the server room

Monitoring access logs for unauthorized attempts to read sensitive files

Analyzing container image vulnerabilities

Certified Kubernetes Security Specialist (CKS)

Domain 4Objective 2

Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 7)

Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

20%of the exam

Questions 31–34

31application · medium
A database administrator notices that a user account with read-only permissions has been querying a table containing credit card numbers at unusual hours. The queries return large result sets. Which detection mechanism would best identify this as a potential data exfiltration?
Select an answer first
32expert · hard
A security analyst is investigating a potential data exfiltration. They notice that a user account has been downloading large amounts of data from an internal server and sending it to an external IP address. The user has legitimate access to the data. Which detection method would best identify this as a malicious activity?
Select an answer first
33application · medium
A security team wants to detect if a containerized application is vulnerable to a known exploit in one of its dependencies. The application is already running in production. Which approach should they use to detect this threat?
Select an answer first
34foundation · easy
Which activity is an example of data threat detection?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 7)

Questions 31–34

A database administrator notices that a user account with read-only permissions has been querying a table containing credit card numbers at unusual hours. The queries return large result sets. Which detection mechanism would best identify this as a potential data exfiltration?

A security team wants to detect if a containerized application is vulnerable to a known exploit in one of its dependencies. The application is already running in production. Which approach should they use to detect this threat?

Which activity is an example of data threat detection?

Keep studying — Supply Chain Security