Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Kubernetes cluster has audit logging enabled, but the security team notices that some API requests are not appearing in the audit logs. They suspect that the audit policy is too restrictive. Which audit policy level should be used to capture the request and response bodies for write operations, which are important for detecting malicious payloads?

   • ARequest
   • BNone
   • CRequestResponse
   • DMetadata
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is monitoring a Kubernetes cluster and notices that a pod is making DNS queries to a domain that has never been seen before in the cluster's DNS logs. The domain is not on any blocklist, and the pod's normal behavior involves only internal service discovery. Which threat detection technique is most directly applicable to flag this activity?

   • ASignature-based detection, because the domain matches a known malware pattern.
   • BRuntime security monitoring with Falco, because it can detect DNS queries.
   • CAnomaly detection using a machine learning model trained on all cluster traffic.
   • DBaseline deviation, because the DNS query pattern deviates from the pod's established behavior.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst detects that a container in a production cluster is executing a known cryptocurrency miner, as identified by a Falco rule. The container is part of a Deployment with three replicas. Which immediate remediation action is most appropriate to contain the threat while minimizing impact on the application?

   • AIsolate the affected pod by applying a NetworkPolicy that denies all egress traffic, then investigate the container image and source.
   • BDelete the entire Deployment to ensure the malicious container is removed.
   • CScale the Deployment to zero replicas to stop all pods, then investigate the container image.
   • DUse kubectl delete pod to remove only the affected pod, allowing the Deployment to recreate a new pod from the same image.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the immediate first step when a container is confirmed to be running malicious code?

   • AIgnore it and continue monitoring
   • BIsolate the container by stopping it or blocking its network access
   • CDelete the entire cluster
   • DImmediately delete the container without preserving logs
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is using a SIEM to analyze Kubernetes audit logs. They want to detect a potential brute-force attack on the API server, where an attacker tries multiple passwords for a user account. Which audit log field is most useful for detecting this pattern?

   • AThe 'responseStatus.code' field, to identify repeated 401 Unauthorized responses.
   • BThe 'requestURI' field, to see which API endpoints are being accessed.
   • CThe 'user.username' field, to identify the account being targeted.
   • DThe 'sourceIPs' field, to see if the requests come from the same IP address.
   Reveal Solution Discussion Select an answer first