Investigate and Identify Phases of Attack and Bad Actors Within the Environment CKS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During a security review, you are examining the threat landscape of a Kubernetes environment. Which of the following is an example of a container-level vulnerability?

   • AAn exposed Kubernetes dashboard without authentication
   • BA container running with the `--privileged` flag
   • CA misconfigured network policy that allows all traffic between pods
   • DAn overly permissive RBAC role that allows a user to create pods in any namespace
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   While reviewing audit logs, you notice a series of failed `kubectl exec` attempts into a pod, followed by a successful `kubectl exec` that ran a command to download a binary from an external IP. Which attack phase does the successful `kubectl exec` most directly indicate?

   • AInstallation
   • BActions on objectives
   • CExploitation
   • DWeaponization
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   While reviewing container logs, you notice a series of failed login attempts to the Kubernetes API server from a single IP address, followed by a successful login and the execution of a command to create a new pod with a suspicious image. Which of the following is the most direct indicator of compromise (IoC) in this log sequence?

   • AThe creation of a pod with a suspicious image
   • BThe execution of a command to create a pod
   • CThe successful login itself
   • DThe series of failed login attempts from a single IP
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A security analyst is investigating a suspected attack. The audit logs show a `kubectl exec` into a pod, followed by the creation of a new pod with a hostPath mount, and then a series of `curl` commands to an external IP. The analyst needs to determine the attack phase to prioritize response. Which phase is the `kubectl exec` most directly indicating?

   • AInstallation
   • BExploitation
   • CActions on objectives
   • DCommand and control
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A disgruntled employee with valid credentials to a Kubernetes cluster deletes critical deployments and modifies RBAC policies to lock out other administrators. Which type of threat actor does this scenario describe?

   • AInsider threat
   • BNation-state actor
   • CExternal attacker
   • DScript kiddie
   Reveal Solution Discussion Select an answer first