Malicious Code Execution and Compromised Applications in Containers KCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of using seccomp in a container runtime?

   • ATo restrict the system calls a container can make
   • BTo encrypt the container's filesystem
   • CTo block all network traffic to the container
   • DTo limit the container's CPU and memory usage
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A cluster administrator is designing a defense-in-depth strategy for a multi-tenant cluster. They want to limit the impact of a container breakout in one tenant. Which combination of measures would be most effective?

   • AUse privileged containers and hostNetwork for all pods.
   • BUse namespaces, ResourceQuotas, and NetworkPolicies.
   • CUse only seccomp profiles and no other measures.
   • DUse a single namespace for all tenants and no NetworkPolicies.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security engineer is investigating a container escape. The container was running with a non-root user and had no capabilities added. However, the attacker was able to gain root access on the host. Which of the following is the most likely vector?

   • AThe container had a kernel vulnerability that was exploited.
   • BThe container was running with privileged: true.
   • CThe container had the Docker socket mounted.
   • DThe container was running as root inside the container.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst notices that a containerized application is spawning new processes that are not part of its normal operation, and the container's root filesystem has been modified. Which runtime security measure would directly detect and block these behaviors?

   • AAn AppArmor profile that restricts process execution and file writes to a whitelist.
   • BA seccomp profile that denies execve and openat system calls.
   • CFalco with rules that alert on unexpected process execution and file writes.
   • DA NetworkPolicy that blocks all outbound traffic.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which runtime security measure makes the container's root filesystem read-only?

   • ASetting the root filesystem to read-only in the container's security context
   • BApplying an AppArmor profile that denies network access
   • CUsing a seccomp profile that blocks all write syscalls
   • DSetting a memory limit on the container
   Reveal Solution Discussion Select an answer first