Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which approach is an example of correlating Falco events to detect a multi-step attack?

   • ADetecting a file read and then a network connection to an external IP
   • BLooking for a single `execve` of `/bin/bash`
   • CCounting the number of running containers
   • DBlocking all pods with the `latest` tag
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which Falco event source is used to detect suspicious API requests to the Kubernetes API server?

   • Asyscall
   • Bcontainer_runtime
   • Ck8s_audit
   • Dk8s_health
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to deploy Falco in a Kubernetes cluster using a Helm chart. They need to ensure that custom rules are included in the deployment. Which approach should they use?

   • ACreate a ConfigMap with the custom rules and mount it into the Falco pod's /etc/falco/rules.d directory
   • BSet the rules as environment variables in the Falco deployment
   • CUse kubectl exec to copy the rules into the running Falco container
   • DModify the Falco binary to include the custom rules
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Falco rule field is used to define the human-readable message that is sent when the rule triggers?

   • Aoutput
   • Bcondition
   • Cpriority
   • Denabled
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which component is required to deploy Falco as a DaemonSet in a Kubernetes cluster?

   • AAn Ingress controller for external access
   • BA ServiceAccount with permissions to read pods
   • CA ConfigMap for storing the Falco rules
   • DA PersistentVolume for storing alerts
   Reveal Solution Discussion Select an answer first