Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of behavioral analytics in a Kubernetes environment?

   • ATo enforce network policies between pods
   • BTo establish a baseline of normal activity and detect deviations that may indicate malicious behavior
   • CTo replace traditional signature-based antivirus tools
   • DTo automatically patch vulnerabilities in container images
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A security team is deploying Falco in a cluster that runs a mix of legacy and modern applications. Some legacy applications are known to perform unusual system calls that are similar to malicious behavior. The team wants to reduce false positives while still detecting real threats. Which configuration strategy is most effective?

   • ARun Falco in a separate cluster and forward alerts to the main cluster.
   • BDisable Falco entirely and rely only on audit logs for detection.
   • CCreate custom Falco rules that whitelist the specific system calls used by the legacy applications.
   • DUse Falco's priority field to set a high priority for all rules, so only critical alerts are sent.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key advantage of anomaly detection over signature-based detection?

   • AIt requires no baseline data
   • BIt is simpler to implement
   • CIt produces fewer false positives
   • DIt can detect previously unknown threats
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which component in the Kubernetes control plane is responsible for generating audit logs?

   • Akube-proxy
   • Bkubelet
   • Ckube-apiserver
   • Detcd
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security engineer is configuring audit logging for a production Kubernetes cluster. The cluster has a single API server and runs a mix of workloads. The engineer needs to capture all API requests that could indicate privilege escalation or unauthorized access, but wants to minimize the volume of logs for routine GET requests that are part of normal cluster operation. Which audit policy configuration best meets this requirement?

   • AEnable audit logging with the default policy, which logs all requests at the RequestResponse level, and rely on the log storage system to compress the data.
   • BSet the audit policy to log all requests at the Metadata level, and then use a separate log-shipping tool to filter out GET requests.
   • CConfigure the audit policy with rules that log write operations (create, update, delete) and requests to sensitive resources, while ignoring read-only GET requests to non-sensitive resources.
   • DUse the --audit-log-maxsize flag to rotate logs frequently, so that the total volume of stored logs remains small.
   Reveal Solution Discussion Select an answer first