CKS Practice Test 43 — 15 Questions

Question 1

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: monitoring-pod
  policyTypes:
  - Ingress
  - Egress. Option B specifies podSelector: matchLabels: app: malicious-pod, ingress from a specific pod (monitoring-pod), and no egress rules, so egress is denied by default. Option A denies all ingress as well (no ingress rules). Option C allows all ingress. Option D allows all egress.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  egress:
  - {}
  policyTypes:
  - Egress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  policyTypes:
  - Ingress
  - Egress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  ingress:
  - {}
  policyTypes:
  - Ingress

Question 2

Which audit policy level logs all requests and responses, including the request body and response body?

Accepted Answer

RequestResponse. RequestResponse logs both the request object and the response object, including bodies. Request logs only the request object. Metadata logs only metadata. None logs nothing.

Answer

None

Answer

Request

Answer

Metadata

Question 3

Which THREE of the following are recommended incident response steps when a container is compromised?

Accepted Answer

Copy the container's filesystem using kubectl cp for offline analysis. Isolating the pod via NetworkPolicy, preserving evidence by copying the filesystem, and capturing logs are key steps. Terminating the pod immediately may lose evidence, and ignoring is not recommended.

Answer

Ignore the incident and monitor for further activity

Answer

Immediately terminate the pod to contain the threat

Question 4

Which Falco rule priority is used to indicate a potentially malicious activity that should be investigated?

Accepted Answer

WARNING. Falco rule priorities are: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG. WARNING is used for potentially malicious activities that warrant investigation.

Answer

INFO

Answer

ERROR

Answer

DEBUG

Question 5

You are investigating a compromised pod. You suspect the attacker used 'kubectl exec' to gain shell access. Which command can you use to check the audit logs for exec events?

Accepted Answer

kubectl exec -it pod-name -- cat /var/log/audit/audit.log. The kubectl logs command fetches logs from a pod, but audit logs are stored on the API server. To view audit logs, you typically read the audit log file (e.g., /var/log/audit/audit.log on the master node) or use a log aggregation tool. kubectl get events shows Kubernetes events, not audit logs.

Answer

kubectl get events

Answer

kubectl logs --audit

Answer

kubectl describe pod pod-name

Question 6

You need to detect when a container attempts to mount the host's Docker socket. Which Falco macro or condition would you use?

Accepted Answer

fd.name=/var/run/docker.sock. Falco has a default macro 'docker_socket' that matches the path '/var/run/docker.sock'. Using fd.name=/var/run/docker.sock in a condition will detect access to the socket. Option A is correct. Option B is a valid path but not the standard. Option C is a directory. Option D is a different socket.

Answer

fd.name=/var/run/containerd.sock

Answer

fd.name=/var/run/docker

Answer

fd.name=/run/docker.sock

Question 7

A Falco rule is configured to detect privilege escalation via setuid binaries. Which syscall is commonly associated with this activity?

Accepted Answer

setuid. The setuid and setgid syscalls are used to change user/group IDs, a common privilege escalation vector. Option D is correct. Option A is file operations. Option B is network. Option C is process execution.

Answer

connect

Answer

open

Answer

execve

Question 8

You are investigating a security incident where a container ran a shell inside a pod. Which Falco rule condition would trigger on a shell spawned in a container?

Accepted Answer

proc.name in (sh, bash). Falco uses syscalls to detect events. The condition 'proc.name=sh' or 'proc.name=bash' matches processes named sh or bash, which are common shells. Option B is incorrect because 'container.id' is not a typical field; Falco uses 'container.id' but the condition is about process name. Option C is too broad. Option D is not the typical way to detect shell execution.

Answer

evt.type=clone and proc.name = 'shell'

Answer

evt.type=execve and proc.name contains 'sh'

Answer

container.id != host and proc.name = shell

Question 9

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

Accepted Answer

Run 'kubectl exec <pod> -- tcpdump -i eth0' to capture packets. Using 'kubectl exec' with tools like tcpdump or netstat allows you to inspect network connections from within the pod. Option B is plausible but not as direct. Option C (Falco) is for runtime security but not specifically for network traffic analysis. Option D is about blocking, not investigation.

Answer

Deploy Falco with a rule to detect outbound connections

Answer

Create a NetworkPolicy to deny all egress traffic

Answer

Check the pod's logs using 'kubectl logs <pod>'

Question 10

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Accepted Answer

crictl is not configured to connect to the correct container runtime socket. crictl uses a specific container runtime socket (e.g., containerd.sock). If the socket is not configured or the runtime is different, it won't see containers. Option A is unlikely, option B is about kubelet, option D is about image pull.

Answer

The images have not been pulled yet

Answer

The containers are running in a different namespace

Answer

The kubelet is not running

Question 11

Which TWO of the following are valid priority levels in Falco rules?

Accepted Answer

WARNING. Falco priority levels include EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG. Option B (HIGH) is not a standard priority; it's CRITICAL. Option D (LOW) is not standard; it's NOTICE or INFO. Option E (MEDIUM) is not standard; it's WARNING or NOTICE.

Answer

MEDIUM

Answer

LOW

Answer

HIGH

Question 12

Which TWO crictl commands can be used to inspect a running container?

Accepted Answer

crictl logs <container-id>. crictl logs shows logs, crictl exec runs a command in the container.

Answer

crictl run <image>

Answer

crictl create <pod-config>

Answer

crictl stats <container-id>

Question 13

Which kubectl command can be used to view the live logs of a container in a pod named 'my-pod'?

Accepted Answer

kubectl logs -f my-pod. The correct command is 'kubectl logs -f my-pod'. The -f flag streams logs in real time.

Answer

kubectl attach my-pod

Answer

kubectl logs my-pod --tail 10

Answer

kubectl exec my-pod -- journalctl

Question 14

You need to configure a NetworkPolicy that allows egress traffic only to an external database at IP 10.0.0.5 on port 5432, and denies all other egress. Which policy BEST achieves this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.5/32
    ports:
    - port: 5432. The correct policy has an egress rule that allows traffic to 10.0.0.5 on port 5432, and no other egress rules, so all other egress is denied by default.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - port: 5432

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: db

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress: []

Question 15

You want to run crictl to list all running containers on a node. Which command should you execute?

Accepted Answer

crictl ps. crictl ps lists containers. By default it shows only running ones. Option A is correct. Option B shows images; Option C shows pods; Option D shows stats.

Answer

crictl stats

Answer

crictl images

Answer

crictl pods