Which Falco rule condition would detect a shell being spawned inside a container?

evt.type=chmod and fd.mode=0777

evt.type=connect and fd.ip=1.2.3.4

evt.type=execve and proc.name=sh

evt.type=open and fd.name=/etc/shadow

A security analyst is reviewing Kubernetes audit logs and notices a series of requests from a user to list pods in the 'kube-system' namespace, each returning a 403 Forbidden. The requests occur every 5 minutes for an hour. Which conclusion is most likely?

The user is performing a denial-of-service attack on the API server

The user is conducting a brute-force attack on the API server

The user is attempting to enumerate resources they are not authorized to access

The user is testing the API server's rate limiting

A security analyst is configuring Falco to monitor both system calls and Kubernetes audit logs. They want to ensure that Falco processes events from both sources. Which configuration is required?

Run two separate Falco instances, one for each event source

Use the 'evt.type' field to switch between sources

Deploy Falco with a custom kernel module for each source

Enable the 'syscall' event source and the 'k8s_audit' event source in falco.yaml

A company is deploying Falco in a Kubernetes cluster and wants to ensure that alerts are sent to a Slack channel. They have configured the Slack webhook in falco.yaml. Which additional configuration is necessary for Falco to load the custom rules they have written?

Restart the Kubernetes API server

Place the custom rule files in /etc/falco/rules.d

Enable the 'k8s_audit' event source

Create a ConfigMap for the Slack webhook

Which of the following activities would be considered a privilege escalation attempt that Falco can detect?

Making an outbound HTTP request

Reading a file inside the container

Certified Kubernetes Security Specialist (CKS)

Domain 6Objective 1

Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 1)

Part of the Monitoring, Logging and Runtime Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

20%of the exam

Questions 1–5

1foundation · easy
Which Falco rule condition would detect a shell being spawned inside a container?
Select an answer first
2expert · hard
A security analyst is reviewing Kubernetes audit logs and notices a series of requests from a user to list pods in the 'kube-system' namespace, each returning a 403 Forbidden. The requests occur every 5 minutes for an hour. Which conclusion is most likely?
Select an answer first
3application · medium
A security analyst is configuring Falco to monitor both system calls and Kubernetes audit logs. They want to ensure that Falco processes events from both sources. Which configuration is required?
Select an answer first
4application · medium
A company is deploying Falco in a Kubernetes cluster and wants to ensure that alerts are sent to a Slack channel. They have configured the Slack webhook in falco.yaml. Which additional configuration is necessary for Falco to load the custom rules they have written?
Select an answer first
5foundation · easy
Which of the following activities would be considered a privilege escalation attempt that Falco can detect?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.