Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary goal of behavioral analytics in Falco?

   • ATo block all network traffic by default
   • BTo identify patterns of activity that deviate from normal behavior
   • CTo replace the need for Kubernetes RBAC
   • DTo automatically patch vulnerabilities in containers
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Falco has detected a container that is executing a reverse shell. The security team wants to immediately stop the malicious activity. Which action should they take to mitigate the threat?

   • ADelete the Falco rule that detected the activity
   • BIncrease the log level of the container runtime
   • CTerminate the pod running the malicious container
   • DRestart the Falco daemon
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Kubernetes resource can be used to block network traffic from a pod that triggered a Falco alert?

   • AResourceQuota
   • BPodSecurityPolicy
   • CNetworkPolicy
   • DLimitRange
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is using Falco to detect malicious activity in a cluster. They observe a single alert for a suspicious command execution in a container, but they suspect it may be part of a larger attack. Which approach would best help them correlate this event with other activities to identify a pattern?

   • AUse Falco's built-in rule that alerts on any execve event and rely on that single alert
   • BIncrease Falco's priority level to 'emergency' for all rules to ensure no events are missed
   • CIntegrate Falco with a SIEM or log aggregation platform to query events by container, user, and time window
   • DEnable Falco's output to a file and manually review all alerts for the same container ID
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team uses Falco to monitor containers. They notice a single alert for a 'suspicious network connection' from a container, but they are unsure if it is malicious. Which additional data would be most useful to correlate with the Falco alert to determine if the activity is part of a broader attack?

   • AThe Kubernetes audit logs for the same time period
   • BThe Falco rule's priority level
   • CThe container's image name and version
   • DThe container's resource usage metrics
   Reveal Solution Discussion Select an answer first