CKS Practice Test 36 — 15 Questions

Question 1

You are configuring Kubernetes audit logging. You want to log all requests to the `secrets` resource in the `kube-system` namespace at the `RequestResponse` level, while logging all other requests at the `Metadata` level. Which audit policy configuration achieves this?

Accepted Answer

rules: [- level: RequestResponse, resources: [group: '', resources: [secrets]], namespaces: [kube-system], - level: Metadata]. Option A is correct because it defines a rule for secrets in kube-system with level RequestResponse, then a default rule for all other resources with level Metadata. Option B incorrectly uses `omitStages` instead of `level`. Option C does not target the specific resource. Option D reverses the levels.

Answer

rules: [- level: RequestResponse, resources: [group: '', resources: [*]], - level: Metadata]

Answer

rules: [- level: Metadata, resources: [group: '', resources: [secrets]], namespaces: [kube-system], - level: RequestResponse]

Answer

rules: [- level: Metadata, resources: [group: '', resources: [secrets]], namespaces: [kube-system], omitStages: [RequestReceived], - level: RequestResponse]

Question 2

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` lists containers, similar to `docker ps`. `crictl pods` lists pods (sandboxes). `crictl images` lists images. `crictl stats` displays resource usage.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats

Question 3

Which crictl command is used to view logs from a specific container?

Accepted Answer

crictl logs . crictl logs fetches logs from a container.

Answer

crictl exec <container-id>

Answer

crictl inspect <container-id>

Answer

crictl ps

Question 4

Which TWO of the following are valid methods to detect a container spawning a shell (e.g., /bin/bash) using Falco? (Select two.)

Accepted Answer

Check if proc.name is 'bash' and container is true. Falco can detect shell spawning by checking spawned_process and container conditions, and specific process names.

Answer

Use the rule 'Launch Sensitive Mount'

Answer

Check if the process's parent is 'sshd'

Answer

Check if evt.type is 'execve' and fd.name contains 'bash'

Question 5

A security team wants to detect any attempt to open /etc/shadow in a container. Which Falco rule condition field is MOST appropriate?

Accepted Answer

evt.type in (open, openat) and fd.name=/etc/shadow. Falco uses the 'evt.type' field to match system call events, and 'fd.name' to match the file descriptor name. Option A correctly checks for openat or open syscalls with target file name containing /etc/shadow.

Answer

proc.name contains 'shadow'

Answer

container.id != host and fd.name=/etc/shadow

Answer

evt.type=read and fd.name=/etc/shadow

Question 6

An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?

Accepted Answer

connect. Falco monitors system calls. Establishing an outbound TCP connection involves the `connect` syscall. Other syscalls like `open`, `execve`, `bind` are not directly related to initiating outbound connections.

Answer

open

Answer

execve

Answer

bind

Question 7

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Accepted Answer

kubectl run temp-pod --image=busybox --restart=Never -- /bin/sh -c 'kubectl label pod compromised-pod isolated=true' && kubectl apply -f networkpolicy.yaml that selects pod with label isolated=true and denies all traffic. Option B is correct: `kubectl run` creates a temporary network policy that denies all ingress and egress traffic to the pod, effectively isolating it. Option A deletes the pod, losing evidence. Option C labels the node, which does not isolate the pod. Option D uses `kubectl exec` to stop the process, which may not work and is not isolation.

Answer

kubectl cordon <node-of-compromised-pod>

Answer

kubectl delete pod compromised-pod && kubectl describe pod compromised-pod

Answer

kubectl exec compromised-pod -- killall miner-process

Question 8

To isolate a compromised pod and prevent all incoming and outgoing traffic, which Kubernetes resource should you use?

Accepted Answer

NetworkPolicy with spec.podSelector: {} and spec.policyTypes: [Ingress, Egress]. NetworkPolicy with empty podSelector and policyTypes: Ingress, Egress denies all traffic.

Answer

ResourceQuota

Answer

PodSecurityPolicy

Answer

LimitRange

Question 9

Which audit stage in Kubernetes audit logging captures the stage after a request is processed and before a response is sent?

Accepted Answer

ResponseStarted. ResponseStarted captures the stage after the request is processed but before the response body is sent.

Answer

ResponseComplete

Answer

Panic

Answer

RequestReceived

Question 10

An administrator needs to preserve evidence from a compromised container. Which approach is BEST for capturing the container's filesystem and memory for later analysis?

Accepted Answer

Use 'crictl export <container-id>' to create a tar archive of the container's filesystem. crictl export exports the container's filesystem as a tar archive. For memory dump, tools like gcore or /proc/.../mem are needed. Option A is the closest match for filesystem preservation among the options. Option B is for runc, not typical. Option D is for images.

Answer

Use 'runc checkpoint' to create a checkpoint of the container

Answer

Use 'kubectl cp' to copy files from the container to the node

Answer

Use 'crictl save' to save the container image

Question 11

You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. Falco uses `evt.type` for syscall type (e.g., open, openat, read) and `fd.name` for the file path. The `open` syscall is typically used to open files; reading can also happen via `openat` or `read`. Option B is correct because it checks for the open syscall and the file path. Option A checks for the `read` syscall but `fd.name` may not be available for read events. Option C uses `proc.name` which is process name, not file. Option D uses `container.name` which is not relevant.

Answer

container.name=shadow and evt.type=open

Answer

evt.type=read and fd.name=/etc/shadow

Answer

proc.name=cat and fd.name=/etc/shadow

Question 12

A Falco rule has priority `WARNING` and output: `Sensitive file opened (user=%user.name command=%proc.cmdline file=%fd.name)`. The rule is triggering correctly. You want to reduce noise from legitimate administrative activity. What is the best approach?

Accepted Answer

Add an exception to the rule to exclude known admin commands. Falco supports rule exceptions to filter out specific conditions. Adding an exception allows you to exclude known legitimate commands without disabling the rule entirely. Option B modifies the rule condition to ignore certain users, but exceptions are more flexible. Option C changes priority, but does not reduce noise. Option D disables the rule entirely.

Answer

Modify the rule condition to add `and not user.name in (admin, root)`

Answer

Change the rule priority to `INFO`

Answer

Disable the rule

Question 13

A pod has securityContext.readOnlyRootFilesystem: true. What happens if a process inside the container tries to write to the root filesystem?

Accepted Answer

The write will fail with an error. The write will fail because the root filesystem is read-only.

Answer

The write will succeed because tmpfs is used

Answer

The kernel will allow the write but log it

Answer

The pod will be restarted

Question 14

An admin runs 'crictl ps' on a node and sees multiple containers. Which command should they use to view the logs of a specific container?

Accepted Answer

crictl logs <container-id>. crictl logs is the correct command to retrieve logs from a container. crictl ps lists containers, crictl exec runs a command inside a container, and crictl inspect shows detailed info.

Answer

crictl exec <container-id> logs

Answer

crictl inspect <container-id>

Answer

crictl ps -a <container-id>

Question 15

You need to ensure that all containers in a pod cannot write to their root filesystem except for a specific directory `/data`. You set `securityContext.readOnlyRootFilesystem: true` and mount an emptyDir volume at `/data`. However, the container still cannot write to `/data`. What is the most likely cause?

Accepted Answer

The container user does not have write permission on the emptyDir volume. The emptyDir volume is mounted at `/data`, but the container process may not have write permissions on the emptyDir volume's default permissions (typically 755 owned by root). The container user must have write access. Option A suggests the emptyDir is not mounted; that would cause a different error. Option C is incorrect because readOnlyRootFilesystem applies to the root filesystem, not the volume. Option D is unrelated.

Answer

The emptyDir volume is not mounted correctly in the pod spec

Answer

The emptyDir volume is using a read-only storage class

Answer

readOnlyRootFilesystem also applies to mounted volumes