CKS Monitoring, Logging and Runtime Security — 20 Questions

Question 1

You are investigating a pod that is suspected of being compromised. You need to preserve the container's filesystem for forensic analysis. Which `crictl` command should you use to export the container's filesystem as a tar archive?

Accepted Answer

crictl export <container-id>. `crictl export` exports the container's filesystem as a tar archive. `crictl inspect` shows container metadata, not filesystem content. `crictl logs` retrieves logs. `crictl exec` runs commands in the container but does not export filesystem.

Answer

crictl logs <container-id>

Answer

crictl inspect <container-id>

Answer

crictl exec <container-id> tar cvf /tmp/fs.tar /

Question 2

A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?

Accepted Answer

The `spawned_process` macro may not match because the process was inherited (not spawned), e.g., from an entrypoint. The condition requires both `spawned_process` and `container` macro fields, which are typical. Option B is the most likely because the `spawned_process` macro might not include all shell spawn scenarios (e.g., inherited processes). Option A is correct but less likely. Options C and D are incorrect.

Answer

The rule is missing `proc.name in (bash, sh, zsh)` because only bash is checked

Answer

Falco is not running with the required syscall capabilities

Answer

The priority is set to `ERROR` but the output is being filtered

Question 3

You are configuring Kubernetes audit logging. You want to log all requests to the `secrets` resource in the `kube-system` namespace at the `RequestResponse` level, while logging all other requests at the `Metadata` level. Which audit policy configuration achieves this?

Accepted Answer

rules: [- level: RequestResponse, resources: [group: '', resources: [secrets]], namespaces: [kube-system], - level: Metadata]. Option A is correct because it defines a rule for secrets in kube-system with level RequestResponse, then a default rule for all other resources with level Metadata. Option B incorrectly uses `omitStages` instead of `level`. Option C does not target the specific resource. Option D reverses the levels.

Answer

rules: [- level: RequestResponse, resources: [group: '', resources: [*]], - level: Metadata]

Answer

rules: [- level: Metadata, resources: [group: '', resources: [secrets]], namespaces: [kube-system], - level: RequestResponse]

Answer

rules: [- level: Metadata, resources: [group: '', resources: [secrets]], namespaces: [kube-system], omitStages: [RequestReceived], - level: RequestResponse]

Question 4

You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?

Accepted Answer

The pod is missing an emptyDir volume mounted at `/tmp`. When `readOnlyRootFilesystem` is true, the container cannot write to any path on the root filesystem unless a writable volume is mounted. `/tmp` is on the root filesystem by default, so the container needs an emptyDir volume mounted at `/tmp` to write there.

Answer

The `securityContext` is misspelled

Answer

The container image does not have `/tmp` directory

Answer

The container is running as a non-root user

Question 5

An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?

Accepted Answer

connect. Falco monitors system calls. Establishing an outbound TCP connection involves the `connect` syscall. Other syscalls like `open`, `execve`, `bind` are not directly related to initiating outbound connections.

Answer

open

Answer

execve

Answer

bind

Question 6

You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. Falco uses `evt.type` for syscall type (e.g., open, openat, read) and `fd.name` for the file path. The `open` syscall is typically used to open files; reading can also happen via `openat` or `read`. Option B is correct because it checks for the open syscall and the file path. Option A checks for the `read` syscall but `fd.name` may not be available for read events. Option C uses `proc.name` which is process name, not file. Option D uses `container.name` which is not relevant.

Answer

container.name=shadow and evt.type=open

Answer

evt.type=read and fd.name=/etc/shadow

Answer

proc.name=cat and fd.name=/etc/shadow

Question 7

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Accepted Answer

kubectl run temp-pod --image=busybox --restart=Never -- /bin/sh -c 'kubectl label pod compromised-pod isolated=true' && kubectl apply -f networkpolicy.yaml that selects pod with label isolated=true and denies all traffic. Option B is correct: `kubectl run` creates a temporary network policy that denies all ingress and egress traffic to the pod, effectively isolating it. Option A deletes the pod, losing evidence. Option C labels the node, which does not isolate the pod. Option D uses `kubectl exec` to stop the process, which may not work and is not isolation.

Answer

kubectl cordon <node-of-compromised-pod>

Answer

kubectl delete pod compromised-pod && kubectl describe pod compromised-pod

Answer

kubectl exec compromised-pod -- killall miner-process

Question 8

Which Kubernetes resource is used to define audit logging configuration?

Accepted Answer

A YAML file specified via `--audit-policy-file`. The audit policy is defined in a YAML file and passed to the kube-apiserver via the `--audit-policy-file` flag. There is no CRD or ConfigMap standard; it's a plain file.

Answer

PodSecurityPolicy

Answer

ConfigMap in kube-system

Answer

AuditPolicy CRD

Question 9

A Falco rule has priority `WARNING` and output: `Sensitive file opened (user=%user.name command=%proc.cmdline file=%fd.name)`. The rule is triggering correctly. You want to reduce noise from legitimate administrative activity. What is the best approach?

Accepted Answer

Add an exception to the rule to exclude known admin commands. Falco supports rule exceptions to filter out specific conditions. Adding an exception allows you to exclude known legitimate commands without disabling the rule entirely. Option B modifies the rule condition to ignore certain users, but exceptions are more flexible. Option C changes priority, but does not reduce noise. Option D disables the rule entirely.

Answer

Modify the rule condition to add `and not user.name in (admin, root)`

Answer

Change the rule priority to `INFO`

Answer

Disable the rule

Question 10

You need to ensure that all containers in a pod cannot write to their root filesystem except for a specific directory `/data`. You set `securityContext.readOnlyRootFilesystem: true` and mount an emptyDir volume at `/data`. However, the container still cannot write to `/data`. What is the most likely cause?

Accepted Answer

The container user does not have write permission on the emptyDir volume. The emptyDir volume is mounted at `/data`, but the container process may not have write permissions on the emptyDir volume's default permissions (typically 755 owned by root). The container user must have write access. Option A suggests the emptyDir is not mounted; that would cause a different error. Option C is incorrect because readOnlyRootFilesystem applies to the root filesystem, not the volume. Option D is unrelated.

Answer

The emptyDir volume is not mounted correctly in the pod spec

Answer

The emptyDir volume is using a read-only storage class

Answer

readOnlyRootFilesystem also applies to mounted volumes

Question 11

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` lists containers, similar to `docker ps`. `crictl pods` lists pods (sandboxes). `crictl images` lists images. `crictl stats` displays resource usage.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats

Question 12

Which audit policy level logs the request metadata and the request body?

Accepted Answer

Request. The `Request` level logs metadata (like user, timestamp) and the request body. `Metadata` logs only metadata. `RequestResponse` logs metadata, request body, and response body. `None` logs nothing.

Answer

None

Answer

Metadata

Answer

RequestResponse

Question 13

Which TWO of the following are valid audit stages in Kubernetes? (Select 2)

Accepted Answer

ResponseStarted. The valid audit stages are RequestReceived, ResponseStarted, ResponseComplete, and Panic. RequestReceived and ResponseComplete are among them. 'RequestEvaluated' and 'ResponseSent' are not valid stages.

Answer

RequestEvaluated

Answer

All of the above

Answer

ResponseSent

Question 14

Which THREE of the following are common indicators of a container compromise that Falco can detect? (Select 3)

Accepted Answer

Unexpected outbound network connections. Falco can detect shell spawning, sensitive file reads, and unexpected outbound connections via syscall monitoring. CPU/memory spikes are not directly detected by Falco as they are not syscall events; they are typically monitored by metrics tools. Pod restart loops are a Kubernetes-level symptom, not a direct syscall event.

Answer

High CPU usage

Answer

Pod restarting in a loop

Question 15

Which TWO are valid stages in a Kubernetes audit event? (Select 2)

Accepted Answer

RequestReceived. The valid stages are RequestReceived, ResponseStarted, ResponseComplete, and Panic. 'PreProcessing' and 'PostProcessing' are not valid stages.

Answer

PreProcessing

Answer

None

Answer

PostProcessing

Question 16

Which kubectl command can be used to exec into a running container for forensic analysis during an incident response?

Accepted Answer

kubectl exec -it -- /bin/sh. The correct command is kubectl exec -it -- /bin/sh, which starts an interactive shell in the container.

Answer

kubectl run --stdin --tty --image=busybox

Answer

kubectl logs <pod>

Answer

kubectl attach <pod>

Question 17

An administrator runs 'falco --list' and sees many default rules. What is the correct way to load a custom Falco rules file?

Accepted Answer

falco -r /path/to/rules.yaml. Use the -r flag to load a custom rules file.

Answer

falco --load /path/to/rules.yaml

Answer

falco --rules /path/to/rules.yaml

Answer

falco --config /path/to/rules.yaml

Question 18

A security team wants to detect any attempt to read /etc/shadow from within a container using Falco. Which condition in a Falco rule would match this behavior?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. The condition checks for an open system call on the file /etc/shadow.

Answer

proc.name contains "shadow" and evt.type=read

Answer

evt.type=read and fd.name contains "shadow"

Answer

container and fd.name=/etc/shadow

Question 19

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

Accepted Answer

RequestResponse. RequestResponse logs request metadata and the request and response body.

Answer

Request

Answer

None

Answer

Metadata

Question 20

You run 'crictl ps' and see no output, but the node has running pods. What is the most likely cause?

Accepted Answer

The --runtime-endpoint flag is not set or points to the wrong socket. crictl uses a socket to communicate with the container runtime; if the socket is wrong, it won't list containers.

Answer

The container runtime is not Docker

Answer

The pod uses a different container runtime than CRI-O

Answer

The containers are in a different namespace