CKS Monitoring, Logging and Runtime Security Practice Test 11 — 15 Questions

Question 1

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

Accepted Answer

securityContext: { readOnlyRootFilesystem: true }. Immutable container filesystem is achieved by setting readOnlyRootFilesystem: true in the securityContext of the container. This prevents writes to the root filesystem.

Answer

securityContext: { runAsNonRoot: true }

Answer

securityContext: { privileged: false }

Answer

securityContext: { capabilities: { drop: ["ALL"] } }

Question 2

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. Access to a file is detected by the 'open' syscall event. To detect reads of /etc/shadow, use 'evt.type=open' and 'fd.name' containing the path.

Answer

evt.type=read and fd.name=/etc/shadow

Answer

spawned_process and proc.name in (cat, less) and container

Answer

evt.type=execve and proc.name=cat and fd.name=/etc/shadow

Question 3

You are using crictl to debug a container. Which command lists all running containers on the node?

Accepted Answer

crictl ps. crictl ps lists containers managed by the CRI runtime. It's analogous to 'docker ps'.

Answer

crictl containers

Answer

crictl get pods

Answer

crictl list

Question 4

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

Accepted Answer

Add a toleration to the pod spec for the taint 'node-role.kubernetes.io/master'. The pod cannot schedule because the node has a taint. To allow the pod to run on that node, add a toleration for that taint in the pod spec.

Answer

Delete the pod and recreate it without any tolerations

Answer

Remove the taint from the node using 'kubectl taint nodes ...'

Answer

Add a nodeSelector to the pod to match the node's labels

Question 5

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

Accepted Answer

crictl logs <container-id>. crictl logs is the command to fetch logs of a container, similar to 'docker logs'.

Answer

crictl status <container-id>

Answer

crictl inspect <container-id>

Answer

crictl log <container-id>

Question 6

You need to enable Kubernetes audit logging with the following requirements: log all requests at the 'RequestResponse' level, but only for successful responses. Which audit stage should you specify in the policy?

Accepted Answer

ResponseComplete. To capture both request and response for successful requests, you want events after the response is complete. The 'ResponseComplete' stage fires after the response is sent. 'RequestResponse' is not a stage; it's a level.

Answer

Panic

Answer

ResponseStarted

Answer

RequestReceived

Question 7

A security policy requires that all pods in a namespace must run with a read-only root filesystem. Which admission controller can enforce this?

Accepted Answer

ValidatingAdmissionPolicy. PodSecurityPolicy is deprecated. The modern approach is to use a ValidatingAdmissionPolicy or an OPA/Gatekeeper policy. Among the options, only 'ValidatingAdmissionPolicy' is a built-in admission controller that can enforce such policies.

Answer

ResourceQuota

Answer

MutatingAdmissionWebhook

Answer

PodSecurityPolicy

Question 8

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

Accepted Answer

Use kubectl cp to copy files from the container to a safe location. To preserve evidence, you should not delete the pod immediately. Instead, use kubectl cp or a sidecar to copy files, or create a snapshot. But the simplest non-destructive step is to copy files from the container using 'kubectl cp' before deletion.

Answer

Exec into the container and delete suspicious files

Answer

Restart the kubelet on the node

Answer

Immediately delete the pod to stop the attack

Question 9

Which TWO of the following are valid audit levels in a Kubernetes audit policy? (Select TWO.)

Accepted Answer

None. Audit levels are None, Metadata, Request, RequestResponse. 'Full' is not valid; 'Response' is not a level; 'Log' is not a level.

Answer

Response

Answer

Log

Answer

Full

Question 10

Which TWO of the following are valid techniques to detect and respond to runtime incidents in a Kubernetes cluster? (Select TWO.)

Accepted Answer

Applying a NetworkPolicy to isolate a compromised pod. 'kubectl exec' can be used for forensics by executing commands inside a container. NetworkPolicy can isolate compromised pods. 'kubectl delete pod' removes evidence. 'crictl images' lists images, not running containers. 'kubectl logs --previous' shows logs of crashed pods but is not a response technique.

Answer

Deleting the compromised pod immediately to stop the attack

Answer

Using crictl images to list container images on the node

Answer

Running kubectl logs --previous to view logs of a terminated container

Question 11

Which THREE of the following are valid Falco rule priorities? (Select THREE.)

Accepted Answer

CRITICAL. Falco defines priorities: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG. 'HIGH', 'MEDIUM', 'LOW' are not standard Falco priorities.

Answer

HIGH

Answer

MEDIUM

Question 12

Which THREE of the following are valid audit stages in Kubernetes audit logging? (Select THREE.)

Accepted Answer

ResponseStarted. Audit stages are: RequestReceived, ResponseStarted, ResponseComplete, Panic. 'RequestProcessing' and 'ResponseBuffered' are not valid stages.

Answer

ResponseBuffered

Answer

RequestProcessing

Question 13

Which kubectl command can be used to view the live logs of a container in a pod named 'my-pod'?

Accepted Answer

kubectl logs -f my-pod. The correct command is 'kubectl logs -f my-pod'. The -f flag streams logs in real time.

Answer

kubectl attach my-pod

Answer

kubectl logs my-pod --tail 10

Answer

kubectl exec my-pod -- journalctl

Question 14

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

Accepted Answer

evt.type in (open, openat) and fd.name=/etc/shadow. Falco uses the 'open' or 'openat' syscall with the 'fd.name' field to check file paths. Option C correctly checks for open and openat syscalls and matches the filename.

Answer

evt.type=read and fd.name=/etc/shadow

Answer

evt.type=open and fd.name contains /etc/shadow

Answer

proc.name=cat and fd.name=/etc/shadow

Question 15

An administrator wants to enable Kubernetes audit logging with the following requirements: log all requests at the Metadata level, but log all responses at the Request level. Which audit policy configuration achieves this?

Accepted Answer

Use separate rules with 'stages: ["RequestReceived"]' level Metadata, and 'stages: ["ResponseComplete"]' level Request. Audit policies are defined with a 'level' per rule or default. To have different levels for requests and responses, you must use different stages. Option B correctly sets the default stage for 'RequestReceived' to Metadata and for 'ResponseComplete' to Request.

Answer

Set default level to Metadata and use a dynamic level based on request size

Answer

Use the --audit-log-maxbackup flag to adjust levels

Answer

Set default level to Metadata and use a rule with level: Request for specific resources