Investigate and Identify Phases of Attack and Bad Actors Within the Environment CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A security team is assessing the attack surface of their Kubernetes cluster. Which of the following is a cluster-level vulnerability that could be exploited by an attacker?

   • AA container running with privileged mode
   • BAn image with a known vulnerability
   • CA pod with a hostPath volume
   • DA misconfigured kubelet that allows unauthenticated access
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an incident investigation, you correlate audit logs showing a service account creating a pod with a hostPath volume, then a container in that pod accessing `/etc/kubernetes` and reading secrets. Which investigation technique is most effective to confirm the full attack timeline?

   • AReview only the container runtime logs
   • BCheck the image registry for the pod's image
   • CCorrelate events across multiple log sources (API server, kubelet, container runtime)
   • DIsolate the pod immediately and terminate it
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an incident, you have audit logs showing a pod was created with a hostPath mount, then a container in that pod accessed `/etc/shadow`. You also have kubelet logs showing the pod was scheduled on a specific node. Which investigation technique would best help you determine if the attacker accessed other nodes?

   • AReview the container image's vulnerability scan
   • BCorrelate the pod's activities with node-level audit logs
   • CIsolate the pod and take a memory dump
   • DCheck the network policy for the pod
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A cluster uses a service account that has `cluster-admin` privileges. An attacker compromises a pod and uses the service account token to create a new pod with a privileged container. Which Kubernetes-specific attack surface is most directly exploited?

   • AContainer runtime vulnerability
   • BNetwork policy misconfiguration
   • CKubelet API exposure
   • DOver-privileged service account
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A security analyst is reviewing network traffic and notices that a container is communicating with an external IP address on a non-standard port, and the traffic is encrypted. The container's legitimate function does not require external communication. Which of the following is the most likely indicator of compromise (IoC)?

   • AThe use of encryption
   • BUnexpected external communication from a container
   • CThe non-standard port
   • DThe external IP address
   Reveal Solution Discussion Select an answer first