A security team is using Falco to detect malicious activity. They notice a container that frequently executes 'wget' to download files, but they are unsure if it is malicious. Which additional behavior would most strongly indicate that the downloads are part of a malicious attack?

The downloads occur during business hours

The downloaded files are immediately executed

The downloads are small in size

The downloads are from a well-known software repository

A security team is using Falco to monitor a cluster. They have a rule that alerts on 'execve' of 'bash' in any container. They are receiving a high volume of alerts from a specific container that runs a legitimate application. Which approach would best reduce false positives while still detecting malicious shell usage?

Change the output channel to a different webhook

Increase the priority level of the rule

Add a condition to the rule to exclude the container's image name

Disable the rule for that specific container

A security team wants to detect when a container attempts to mount a host directory, which could indicate an attempt to access host files. Which Falco rule condition would detect this behavior?

evt.type=chmod and fd.name=/etc

evt.type=open and fd.name=/host

evt.type=mount and mount.type=bind

evt.type=execve and proc.name=mount

Certified Kubernetes Security Specialist (CKS)

Domain 6Objective 1

Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 4)

Part of the Monitoring, Logging and Runtime Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

20%of the exam

Questions 16–20

16foundation · easy
Which audit log field indicates whether the API request was successful or denied?
Select an answer first
17expert · hard
A security team is using Falco to detect malicious activity. They notice a container that frequently executes 'wget' to download files, but they are unsure if it is malicious. Which additional behavior would most strongly indicate that the downloads are part of a malicious attack?
Select an answer first
18foundation · easy
Which output channel can Falco be configured to use to send alerts to a SIEM system?
Select an answer first
19expert · hard
A security team is using Falco to monitor a cluster. They have a rule that alerts on 'execve' of 'bash' in any container. They are receiving a high volume of alerts from a specific container that runs a legitimate application. Which approach would best reduce false positives while still detecting malicious shell usage?
Select an answer first
20application · medium
A security team wants to detect when a container attempts to mount a host directory, which could indicate an attempt to access host files. Which Falco rule condition would detect this behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 4)

Questions 16–20

Which audit log field indicates whether the API request was successful or denied?

A security team is using Falco to detect malicious activity. They notice a container that frequently executes 'wget' to download files, but they are unsure if it is malicious. Which additional behavior would most strongly indicate that the downloads are part of a malicious attack?

Which output channel can Falco be configured to use to send alerts to a SIEM system?

A security team wants to detect when a container attempts to mount a host directory, which could indicate an attempt to access host files. Which Falco rule condition would detect this behavior?

Keep studying — Monitoring, Logging and Runtime Security