CKS Monitoring, Logging and Runtime Security Practice Test 10 — 15 Questions

Question 1

A security engineer wants to detect any attempt to spawn a shell inside a container. Which Falco rule condition would trigger on a shell being spawned in a container (e.g., /bin/bash or /bin/sh)?

Accepted Answer

spawned_process and container and proc.name in (bash, sh, zsh). Falco uses syscall events. Container spawning a shell is detected by looking for spawned processes with a shell binary, excluding the container's own entrypoint. The condition 'spawned_process and container and proc.name in (bash, sh, zsh)' is correct.

Answer

evt.type=open and fd.name contains /bin/bash

Answer

evt.type=execve and container and proc.name in (bash, sh, zsh)

Answer

proc.name = bash and container

Question 2

You need to configure the Kubernetes API server to enable audit logging at the 'Metadata' level for all requests. Which flag should be used when starting the kube-apiserver?

Accepted Answer

--audit-policy-file=/etc/kubernetes/audit-policy.yaml. Audit logging is enabled by specifying --audit-policy-file pointing to a policy file. The policy file defines the level. The flag itself is --audit-policy-file.

Answer

--feature-gates=Auditing=true

Answer

--audit-log-path=/var/log/audit.log

Answer

--audit-log-maxsize=100

Question 3

During a security incident, you need to isolate a compromised pod named 'malicious-pod' in namespace 'default' to prevent it from communicating with other pods. Which command should you run?

Accepted Answer

kubectl apply -f networkpolicy.yaml. Pod isolation is achieved by applying a NetworkPolicy that denies ingress/egress traffic. 'kubectl apply -f networkpolicy.yaml' applies the policy. The policy must be written to deny all traffic.

Answer

kubectl run networkpolicy --image=nginx --restart=Never

Answer

kubectl delete pod malicious-pod

Answer

kubectl create networkpolicy isolate --pod-selector=app=malicious --policy-types=Ingress,Egress

Question 4

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

Accepted Answer

securityContext: { readOnlyRootFilesystem: true }. Immutable container filesystem is achieved by setting readOnlyRootFilesystem: true in the securityContext of the container. This prevents writes to the root filesystem.

Answer

securityContext: { runAsNonRoot: true }

Answer

securityContext: { privileged: false }

Answer

securityContext: { capabilities: { drop: ["ALL"] } }

Question 5

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. Access to a file is detected by the 'open' syscall event. To detect reads of /etc/shadow, use 'evt.type=open' and 'fd.name' containing the path.

Answer

evt.type=read and fd.name=/etc/shadow

Answer

spawned_process and proc.name in (cat, less) and container

Answer

evt.type=execve and proc.name=cat and fd.name=/etc/shadow

Question 6

You are using crictl to debug a container. Which command lists all running containers on the node?

Accepted Answer

crictl ps. `crictl ps` is the command used to list running containers on a node when using the CRI (Container Runtime Interface) compatible runtimes like containerd or CRI-O. It mirrors the Docker `docker ps` syntax and shows only running containers by default, which is exactly what the question asks for.

Answer

crictl containers

Answer

crictl get pods

Answer

crictl list

Question 7

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

Accepted Answer

Add a toleration to the pod spec for the taint 'node-role.kubernetes.io/master'. The pod cannot schedule because the node has a taint. To allow the pod to run on that node, add a toleration for that taint in the pod spec.

Answer

Delete the pod and recreate it without any tolerations

Answer

Remove the taint from the node using 'kubectl taint nodes ...'

Answer

Add a nodeSelector to the pod to match the node's labels

Question 8

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

Accepted Answer

crictl logs <container-id>. crictl logs is the command to fetch logs of a container, similar to 'docker logs'.

Answer

crictl status <container-id>

Answer

crictl inspect <container-id>

Answer

crictl log <container-id>

Question 9

You need to enable Kubernetes audit logging with the following requirements: log all requests at the 'RequestResponse' level, but only for successful responses. Which audit stage should you specify in the policy?

Accepted Answer

ResponseComplete. To capture both request and response for successful requests, you want events after the response is complete. The 'ResponseComplete' stage fires after the response is sent. 'RequestResponse' is not a stage; it's a level.

Answer

Panic

Answer

ResponseStarted

Answer

RequestReceived

Question 10

A security policy requires that all pods in a namespace must run with a read-only root filesystem. Which admission controller can enforce this?

Accepted Answer

ValidatingAdmissionPolicy. ValidatingAdmissionPolicy is a built-in admission controller that uses CEL to validate pod security contexts, such as readOnlyRootFilesystem, without external webhooks. MutatingAdmissionWebhook is also a built-in admission controller but relies on an external webhook service to enforce policies, making it less direct. PodSecurityPolicy is deprecated, and ResourceQuota does not handle security settings. Therefore, ValidatingAdmissionPolicy is the correct answer.

Answer

ResourceQuota

Answer

MutatingAdmissionWebhook

Answer

PodSecurityPolicy

Question 11

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

Accepted Answer

Use kubectl cp to copy files from the container to a safe location. To preserve evidence, you should not delete the pod immediately. Instead, use kubectl cp or a sidecar to copy files, or create a snapshot. But the simplest non-destructive step is to copy files from the container using 'kubectl cp' before deletion.

Answer

Exec into the container and delete suspicious files

Answer

Restart the kubelet on the node

Answer

Immediately delete the pod to stop the attack

Question 12

Which TWO of the following are valid audit levels in a Kubernetes audit policy? (Select TWO.)

Accepted Answer

None. Audit levels are None, Metadata, Request, RequestResponse. 'Full' is not valid; 'Response' is not a level; 'Log' is not a level.

Answer

Response

Answer

Log

Answer

Full

Question 13

Which TWO of the following are valid techniques to detect and respond to runtime incidents in a Kubernetes cluster? (Select TWO.)

Accepted Answer

Applying a NetworkPolicy to isolate a compromised pod. 'kubectl exec' can be used for forensics by executing commands inside a container. NetworkPolicy can isolate compromised pods. 'kubectl delete pod' removes evidence. 'crictl images' lists images, not running containers. 'kubectl logs --previous' shows logs of crashed pods but is not a response technique.

Answer

Deleting the compromised pod immediately to stop the attack

Answer

Using crictl images to list container images on the node

Answer

Running kubectl logs --previous to view logs of a terminated container

Question 14

Which THREE of the following are valid Falco rule priorities? (Select THREE.)

Accepted Answer

CRITICAL. Falco defines a specific set of priority levels for rule output, and CRITICAL is one of the valid priorities. It is used for the most severe security events that require immediate attention, such as a container breakout attempt. The official Falco documentation lists CRITICAL as a valid priority, along with EMERGENCY and ALERT.

Answer

HIGH

Answer

MEDIUM

Question 15

Which THREE of the following are valid audit stages in Kubernetes audit logging? (Select THREE.)

Accepted Answer

ResponseStarted. Audit stages are: RequestReceived, ResponseStarted, ResponseComplete, Panic. 'RequestProcessing' and 'ResponseBuffered' are not valid stages.

Answer

ResponseBuffered

Answer

RequestProcessing