In the context of a Kubernetes attack, which sequence correctly represents the typical phases of an attack lifecycle, from the attacker's perspective?

Initial Access, Execution, Reconnaissance, Persistence, Privilege Escalation, Lateral Movement, Impact

Initial Access, Reconnaissance, Privilege Escalation, Execution, Persistence, Lateral Movement, Impact

Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, Impact

Reconnaissance, Initial Access, Privilege Escalation, Persistence, Execution, Lateral Movement, Impact

A forensic investigator needs to analyze the contents of a container that is part of a compromised pod. Which of the following is the most appropriate technique to collect forensic artifacts from the container?

Using `kubectl exec` to run commands inside the container and capture output

Using `kubectl describe pod` to get pod details

Using `kubectl logs` to retrieve the container's logs

Deleting the pod and recreating it to capture a fresh state

Certified Kubernetes Security Specialist (CKS)

Domain 4Objective 3

Investigate and Identify Phases of Attack and Bad Actors Within the Environment CKS Practice Questions (Page 2)

Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

5concepts

20%of the exam

Questions 6–10

6foundation · easy
In the context of a Kubernetes attack, which sequence correctly represents the typical phases of an attack lifecycle, from the attacker's perspective?
Select an answer first
7foundation · easy
A developer with valid credentials to the Kubernetes cluster deliberately deploys a pod that mounts the host filesystem and then uses that access to read sensitive data from the node. Which type of threat actor does this scenario best describe?
Select an answer first
8foundation · easy
A forensic investigator needs to analyze the contents of a container that is part of a compromised pod. Which of the following is the most appropriate technique to collect forensic artifacts from the container?
Select an answer first
9expert · medium
A company has a Kubernetes cluster that is used for both production and development. A developer with access to the cluster accidentally deploys a pod with a misconfigured security context that allows privilege escalation. An attacker exploits this misconfiguration to gain access to the node. Which type of bad actor is the developer?
Select an answer first
10expert · medium
During a forensic investigation, a security analyst needs to collect the container logs from a compromised pod. The pod is still running, but the analyst wants to preserve the logs for analysis. Which command should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Investigate and Identify Phases of Attack and Bad Actors Within the Environment CKS Practice Questions (Page 2)

Questions 6–10

In the context of a Kubernetes attack, which sequence correctly represents the typical phases of an attack lifecycle, from the attacker's perspective?

A developer with valid credentials to the Kubernetes cluster deliberately deploys a pod that mounts the host filesystem and then uses that access to read sensitive data from the node. Which type of threat actor does this scenario best describe?

A forensic investigator needs to analyze the contents of a container that is part of a compromised pod. Which of the following is the most appropriate technique to collect forensic artifacts from the container?

During a forensic investigation, a security analyst needs to collect the container logs from a compromised pod. The pod is still running, but the analyst wants to preserve the logs for analysis. Which command should the analyst use?

Keep studying — Supply Chain Security