Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falco rule has fired, indicating that a container is attempting to mount the host filesystem. The container is running as root. What is the most immediate action to contain this threat?

   • AUse 'kubectl exec' to enter the container and remove the mounted host path.
   • BKill the container process using 'kill' from the host.
   • CImmediately delete the pod and then investigate the pod's security context and image.
   • DApply a NetworkPolicy to deny all ingress and egress traffic to the pod.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which flag is used to specify the file where Kubernetes audit logs are written?

   • A--audit-webhook-config
   • B--audit-policy-file
   • C--audit-log-path
   • D--log-file
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which pattern in audit logs is most indicative of a potential privilege escalation attempt?

   • AA user updating a ConfigMap in their namespace
   • BA controller reconciling a Deployment
   • CA user repeatedly listing pods in their own namespace
   • DA service account creating a pod with hostPID: true
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A security team is investigating a series of suspicious API calls that appear to be using a legitimate service account token. The calls are creating pods with hostPath mounts and then deleting them quickly. The team suspects that the token has been compromised. Which combination of techniques would best confirm this suspicion?

   • ARevoke the service account token immediately and recreate the service account.
   • BAnalyze the audit logs for the user agent string to see if it matches the normal behavior of the service account.
   • CUse a signature-based detection tool to check if the pods match a known malware pattern.
   • DCorrelate the audit logs with Falco alerts to see if the pods are executing malicious commands, and check if the token has been used from an unusual IP address.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team wants to implement behavioral analytics for their Kubernetes cluster. They have enabled audit logging and are collecting logs from the API server. They also have Falco running on each node. Which additional step is essential to effectively perform behavioral analytics?

   • ADisable anonymous access to the API server to reduce the attack surface.
   • BEnable Kubernetes Dashboard to visualize cluster activity.
   • CEstablish a baseline of normal behavior for users, service accounts, and workloads.
   • DEnsure that all pods have resource limits set to prevent resource exhaustion.
   Reveal Solution Discussion Select an answer first