Which action is part of the mitigation phase after a security incident in Kubernetes?

Deleting all audit logs to clean up

Restarting the cluster without changes

Patching the vulnerability that was exploited

Only sending an alert to the security team

Which data source is most commonly used as the foundation for behavioral analytics in a Kubernetes control plane?

Container image registry metadata

A security analyst is investigating a potential compromise. The audit logs show that a service account 'deployer' created a new pod with a hostPath mount to /var/run/docker.sock. The pod then ran a command that created a new user on the host. The analyst needs to determine the scope of the compromise. Which sequence of actions is most appropriate?

Isolate the node by cordoning it and draining all pods.

Reset all service account tokens in the cluster to prevent further access.

Correlate the audit log entries with Falco alerts and node-level logs to trace the attacker's actions and identify other affected resources.

Immediately delete the pod and the service account, then restore from backup.

What is the primary purpose of Falco in a Kubernetes environment?

To monitor runtime behavior of containers and detect suspicious system calls

To scan container images for vulnerabilities

To enforce network policies between pods

Certified Kubernetes Security Specialist (CKS)

Domain 4Objective 1

Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 2)

Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

20%of the exam

Questions 6–10

6foundation · easy
Which action is part of the mitigation phase after a security incident in Kubernetes?
Select an answer first
7foundation · easy
Which data source is most commonly used as the foundation for behavioral analytics in a Kubernetes control plane?
Select an answer first
8expert · medium
A security analyst is investigating a potential compromise. The audit logs show that a service account 'deployer' created a new pod with a hostPath mount to /var/run/docker.sock. The pod then ran a command that created a new user on the host. The analyst needs to determine the scope of the compromise. Which sequence of actions is most appropriate?
Select an answer first
9foundation · easy
What is the primary purpose of Falco in a Kubernetes environment?
Select an answer first
10foundation · easy
Which technology does Falco commonly use to capture system calls in modern kernels?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 2)

Questions 6–10

Which action is part of the mitigation phase after a security incident in Kubernetes?

Which data source is most commonly used as the foundation for behavioral analytics in a Kubernetes control plane?

What is the primary purpose of Falco in a Kubernetes environment?

Which technology does Falco commonly use to capture system calls in modern kernels?

Keep studying — Supply Chain Security