Monitoring, Logging and Runtime Security

A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?

You are configuring Kubernetes audit logging. You want to log all requests to the `secrets` resource in the `kube-system` namespace at the `RequestResponse` level, while logging all other requests at the `Metadata` level. Which audit policy configuration achieves this?

You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?

An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?

You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Which Kubernetes resource is used to define audit logging configuration?

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Which audit policy level logs the request metadata and the request body?

Which TWO of the following are valid audit stages in Kubernetes? (Select 2)

Which THREE of the following are common indicators of a container compromise that Falco can detect? (Select 3)

Which TWO are valid stages in a Kubernetes audit event? (Select 2)

Which kubectl command can be used to exec into a running container for forensic analysis during an incident response?

An administrator runs 'falco --list' and sees many default rules. What is the correct way to load a custom Falco rules file?

A security team wants to detect any attempt to read /etc/shadow from within a container using Falco. Which condition in a Falco rule would match this behavior?

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

You run 'crictl ps' and see no output, but the node has running pods. What is the most likely cause?

A Falco rule has the following condition: spawned_process and container and proc.name = bash and proc.pname != sshd. What does this rule detect?

You need to preserve evidence (container logs) from a compromised pod before deleting it. Which command should you run first?

Which audit stage in Kubernetes audit logging captures the stage after a request is processed and before a response is sent?

Which crictl command is used to view logs from a specific container?

A pod has securityContext.readOnlyRootFilesystem: true. What happens if a process inside the container tries to write to the root filesystem?

Which of the following is NOT a valid priority level in a Falco rule?

Which TWO of the following are valid methods to detect a container spawning a shell (e.g., /bin/bash) using Falco? (Select two.)

Which THREE of the following are required components to enable audit logging in Kubernetes? (Select three.)

Which TWO of the following are valid steps to respond to a runtime security incident where a container is suspected to be compromised? (Select two.)

An admin runs 'crictl ps' on a node and sees multiple containers. Which command should they use to view the logs of a specific container?

A pod is running in the 'default' namespace with a container that has an immutable root filesystem (readOnlyRootFilesystem: true). The application writes logs to /var/log/app.log. What will happen?

A pod named 'busybox-pod' is compromised. You want to isolate it from all other pods using a NetworkPolicy. Which YAML snippet correctly denies all ingress and egress traffic to/from the pod?

During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?

An audit policy is configured with the following rule: - level: RequestResponse users: ["system:serviceaccount:kube-system:admin"] verbs: ["get", "list"] resources: - group: "" resources: ["secrets"] What will be logged when the service account 'admin' in kube-system performs a GET request on a Secret?

You need to detect any unexpected outbound connections from pods in the 'production' namespace. Which Falco rule condition is MOST appropriate?

To ensure a container's filesystem is read-only, which field should be set to 'true' in the container spec?

Which TWO of the following are valid audit stages in Kubernetes audit logging? (Choose two)

Which THREE Falco priority levels sequences are correctly ordered from lowest to highest severity? (Choose three)

An administrator wants to monitor runtime security events in Kubernetes using Falco. Which component must be deployed as a DaemonSet to capture system calls from containers?

A security team wants to detect attempts to read /etc/shadow inside containers. Which Falco rule condition would trigger on a container reading that file?

You are investigating a pod that may have been compromised. Which kubectl command allows you to run a shell inside the running container without overwriting the container's filesystem?

An audit policy is configured with level: Request. Which operations are recorded in the audit log?

A cluster administrator wants to enforce that containers run with a read-only root filesystem. Which security context field should be set?

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

A Falco rule has priority: CRITICAL and condition: evt.type=execve and proc.name!=bash. What does this rule detect?

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

You run 'crictl ps' and see a container with state CONTAINER_RUNNING. What does this indicate?

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

A security team wants to detect any attempt to spawn an interactive shell inside a container. Which Falco rule condition would be appropriate?

You have configured an audit policy with level: Request. Which request information is logged?

You are investigating a pod suspected of being compromised. Which set of commands would provide the most useful forensic evidence without altering the container's state?

What is the purpose of setting a container's filesystem to read-only in a Pod spec?

Which crictl command can you use to view the logs of a specific container?

An admin runs 'kubectl get pods' and sees a pod in 'CrashLoopBackOff' state. The pod's containers have a restart policy of 'Always'. What is the most likely cause?

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

Which THREE of the following are recommended incident response steps when a container is compromised?

Which TWO tools can be used to directly interact with the container runtime (without going through the Kubernetes API) for troubleshooting?

You need to configure Kubernetes audit logging to log all requests at the Metadata level for a specific namespace. Which audit policy level should you use?

Which crictl command is used to view the logs of a specific container?

A Falco rule is triggered when a shell is spawned inside a container. Which syscall is typically used to detect shell execution?

You are investigating a compromised pod. You suspect the attacker used 'kubectl exec' to gain shell access. Which command can you use to check the audit logs for exec events?

You have deployed a DaemonSet to run a logging agent on every node. After an update, the new pods are stuck in 'Pending' state. You run 'kubectl describe pod ds-pod-xxxxx' and see '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the MOST likely cause?

Which Falco rule condition would detect an attempt to read the /etc/shadow file in a container?

You want to ensure that a container's root filesystem is immutable. Which field in the Pod spec should you set?

You need to configure a NetworkPolicy that allows egress traffic only to an external database at IP 10.0.0.5 on port 5432, and denies all other egress. Which policy BEST achieves this?

You have a pod that is in CrashLoopBackOff. You want to inspect the logs from the previous instance of the container. Which flag should you use with kubectl logs?

Which THREE of the following are recommended steps during incident response for a compromised pod?

Which TWO tools can be used to directly interact with a container runtime on a Kubernetes node without using kubectl?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would trigger an alert for such an event?

You want to run crictl to list all running containers on a node. Which command should you execute?

A pod runs with an immutable root filesystem (readOnlyRootFilesystem: true). The application attempts to write to /tmp. What is the expected behavior?

A developer reports that a pod cannot reach an external database at 192.168.1.100:3306. The pod's namespace is 'app'. You need to create a NetworkPolicy that allows egress to that IP only. Which policy is correct?

You need to detect when a container attempts to mount the host's Docker socket. Which Falco macro or condition would you use?

You want to isolate a compromised pod by blocking all network traffic to and from it. Which NetworkPolicy would you apply?

A Falco rule is configured to detect privilege escalation via setuid binaries. Which syscall is commonly associated with this activity?

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

You need to configure a Kubernetes Pod to have an immutable root filesystem. Which field should you set in the Pod spec?

An incident responder needs to isolate a compromised pod immediately without deleting it. Which action should they take?

Which crictl command is used to view the logs of a specific container in a node?

In a Falco rule, what does the 'priority' field indicate?

You are writing a Falco rule to detect when a container tries to read /etc/shadow. Which condition should you use?

An audit policy is configured with the following rule: - level: Metadata resources: - group: "" resources: ["secrets"] What does this rule log for requests to the Secrets API?

Which kubectl command can be used to execute a shell inside a running container for forensic analysis?

You need to create a NetworkPolicy that allows only ingress traffic from pods with label 'app: frontend' in the same namespace. Which policyType and ingress rule should you use?

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Which THREE of the following are effective methods to preserve evidence during a container security incident?

Which TWO of the following are valid priority levels in Falco rules?

A security admin needs to audit all API requests to the Kubernetes API server. Which audit policy level logs the request body and response body?

Falco detects a shell being opened inside a container. Which Falco rule field is used to specify the syscall condition for detection?

An administrator wants to set an immutable root filesystem for a container in a Pod. Which securityContext field should be set to true?

Which crictl command is used to list all running containers managed by the container runtime?

A pod is stuck in Pending state. You run 'kubectl describe pod' and see the event: '0/3 nodes are available: 3 Insufficient cpu'. What is the likely cause?

Which audit stage is logged after the request is fully processed and the response is sent?

A Falco rule detects unexpected outbound connections. Which condition would identify a connection to an external IP not in the allowed list?

You need to ensure a container's filesystem is immutable at runtime except for a temporary volume. Which Pod spec configuration achieves this?

Which TWO of the following are valid Falco rule priorities?

Which TWO of the following are true about Kubernetes audit logging?

You suspect a container is running an unexpected process. Which crictl command can you use to list all running containers on the node?

Which flag is used when starting kube-apiserver to enable audit logging?

In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

You run 'kubectl exec -it <pod> -- /bin/sh' inside a pod that has an immutable root filesystem. What happens?

Which audit policy level logs all requests and responses, including the request body and response body?

Which kubectl command(s) can you use to view the logs of a specific container in a multi-container pod? (Select all that apply)

You need to configure the Kubernetes API server to enable audit logging at the 'Metadata' level for all requests. Which flag should be used when starting the kube-apiserver?

During a security incident, you need to isolate a compromised pod named 'malicious-pod' in namespace 'default' to prevent it from communicating with other pods. Which command should you run?

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

You are using crictl to debug a container. Which command lists all running containers on the node?

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

Which TWO of the following are valid audit levels in a Kubernetes audit policy? (Select TWO.)

Which TWO of the following are valid techniques to detect and respond to runtime incidents in a Kubernetes cluster? (Select TWO.)

Which THREE of the following are valid audit stages in Kubernetes audit logging? (Select THREE.)

Which kubectl command can be used to view the live logs of a container in a pod named 'my-pod'?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

An administrator wants to enable Kubernetes audit logging with the following requirements: log all requests at the Metadata level, but log all responses at the Request level. Which audit policy configuration achieves this?

A pod named 'compromised-pod' is suspected of making unauthorized outbound connections. You want to isolate the pod using a NetworkPolicy. Which policy correctly denies all egress traffic from the pod?

Which crictl command lists all running containers on a node?

Which TWO of the following are valid audit policy levels in Kubernetes? (Choose two.)

Which THREE of the following are recommended steps during incident response for a compromised pod? (Choose three.)

Which TWO of the following Falco fields can be used in a rule condition to detect a shell spawned inside a container? (Choose two.)

Which TWO of the following are valid audit stages in Kubernetes? (Choose two.)

A CKS candidate is investigating a pod that appears to have been compromised. The incident response team wants to capture the exact system calls made by processes inside the container to understand the attacker's actions. Which Kubernetes-native feature or tool should be used to collect this syscall-level telemetry?

A security engineer is hardening a Kubernetes cluster and wants to ensure that any container attempting to load a kernel module is immediately detected and logged. They have deployed Falco on all nodes. Which Falco rule condition should they use to detect this activity?

A security analyst notices that a Falco rule intended to detect writes to /etc inside containers is generating alerts for a legitimate application that writes to /etc/app/config. The analyst wants to refine the rule to exclude this specific path while still detecting other writes to /etc. Which Falco rule condition modification should be applied?

A cluster runs Kubernetes 1.29 with the AppArmor support enabled. A pod manifest sets securityContext.appArmorProfile.type to Localhost with localhostProfile: k8s-nginx. The pod stays in ContainerCreating and the kubelet logs show a failed to apply AppArmor profile error. Which action most directly resolves the failure?

A security analyst needs to detect and record attempts to modify Kubernetes audit-relevant resources. The cluster already forwards audit logs to a SIEM. Which configuration ensures the API server records both the request and the response for changes to Secrets, while keeping other requests at a lighter level?

A cluster uses containerd and a security team wants to block containers from loading kernel modules. They apply a pod with securityContext.seccompProfile.type set to Localhost and a profile that returns SCMP_ACT_ERRNO for the init_module and finit_module syscalls. The pod starts but a test binary still loads a module. Which is the most likely cause?

A platform team is hardening a namespace that runs tenant workloads. They want runtime detection that flags container escapes and unexpected privilege changes. Which TWO Falco rule fields or conditions are most appropriate to detect these behaviors? (Choose two.)