Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In an audit log entry, which field indicates whether a request was successful?

   • ArequestReceivedTimestamp
   • Bverb
   • Cuser.username
   • DresponseStatus.code
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst has identified a compromised pod that is sending sensitive data to an external IP address. The pod is part of a StatefulSet with a persistent volume. Which remediation action should be taken first to stop the data exfiltration while preserving the ability to investigate?

   • AScale the StatefulSet to zero replicas to stop the pod.
   • BDelete the StatefulSet to remove all pods and the persistent volume.
   • CApply a NetworkPolicy that denies all egress traffic from the pod.
   • DUse kubectl exec to kill the process inside the container that is sending data.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An analyst is reviewing audit logs and sees that a user 'alice' has successfully created a RoleBinding that grants cluster-admin privileges to a service account 'ci-bot'. This is the first time 'alice' has performed such an action. Which set of audit log entries would be most important to correlate for this potential privilege escalation?

   • AThe authentication token used by 'alice' and the IP address from which the request originated.
   • BThe GET request by 'alice' to list all namespaces and the POST request to create the RoleBinding.
   • CThe POST request to create the RoleBinding and the subsequent GET requests by 'ci-bot' to list secrets.
   • DThe DELETE request to remove an old RoleBinding and the POST request to create the new one.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which threat detection technique relies on a predefined set of known malicious patterns?

   • ASignature-based detection
   • BHeuristic analysis
   • CAnomaly detection
   • DBaseline deviation
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A large organization runs a multi-tenant Kubernetes cluster with hundreds of namespaces. The security team has implemented audit logging and Falco, but they are overwhelmed by the volume of alerts, many of which are false positives. They need to improve the signal-to-noise ratio of their behavioral analytics. Which approach is most effective?

   • ACreate per-namespace baselines of normal behavior and tune Falco rules and audit policy rules based on those baselines.
   • BIncrease the audit log level to RequestResponse for all resources to get more data for analysis.
   • CUse a machine learning model to automatically suppress all alerts that are not confirmed by a human analyst.
   • DDisable Falco rules that have a high false positive rate, even if they detect some real threats.
   Reveal Solution Discussion Select an answer first