CKS Monitoring, Logging and Runtime Security Practice Test 11 — 15 Questions

Question 1

Which kubectl command can be used to view the live logs of a container in a pod named 'my-pod'?

Accepted Answer

kubectl logs -f my-pod. The correct command is 'kubectl logs -f my-pod'. The -f flag streams logs in real time.

Answer

kubectl attach my-pod

Answer

kubectl logs my-pod --tail 10

Answer

kubectl exec my-pod -- journalctl

Question 2

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

Accepted Answer

evt.type in (open, openat) and fd.name=/etc/shadow. Falco rules for file access typically use the 'open' or 'openat' syscall events. The 'evt.type in (open, openat)' matches both syscalls, and 'fd.name=/etc/shadow' exactly matches the target file. Option B is incorrect because a 'read' syscall alone doesn't indicate opening a file; the file descriptor is already open. Option C is invalid because 'contains' is not a valid operator in Falco conditions. Option D is too narrow because it only triggers when the command is 'cat', missing other tools like 'less' or 'vim'.

Answer

evt.type=read and fd.name=/etc/shadow

Answer

evt.type=open and fd.name contains /etc/shadow

Answer

proc.name=cat and fd.name=/etc/shadow

Question 3

An administrator wants to enable Kubernetes audit logging with the following requirements: log all requests at the Metadata level, but log all responses at the Request level. Which audit policy configuration achieves this?

Accepted Answer

Use separate rules with 'stages: ["RequestReceived"]' level Metadata, and 'stages: ["ResponseComplete"]' level Request. Audit policies allow setting different levels for different stages. To meet the requirement of logging requests at Metadata level and responses at Request level, you need separate rules for each stage. Option D does this by using two rules: one with stages: ['RequestReceived'] and level: Metadata, and another with stages: ['ResponseComplete'] and level: Request. This ensures that request events are logged at Metadata level and response events at Request level.

Answer

Set default level to Metadata and use a dynamic level based on request size

Answer

Use the --audit-log-maxbackup flag to adjust levels

Answer

Set default level to Metadata and use a rule with level: Request for specific resources

Question 4

A pod named 'compromised-pod' is suspected of making unauthorized outbound connections. You want to isolate the pod using a NetworkPolicy. Which policy correctly denies all egress traffic from the pod?

Accepted Answer

NetworkPolicy with podSelector: matchLabels: app: compromised and egress: []. A NetworkPolicy with podSelector matching 'compromised-pod' (via label app=compromised) and an empty egress list (egress: []) explicitly denies all egress traffic from the pod. This is the standard Kubernetes pattern to isolate a pod by default-deny egress. Option A allows egress to 0.0.0.0/0, which permits all outbound traffic. Option B only restricts ingress, not egress. Option D allows egress to pods matching an empty podSelector (all pods), thus permitting traffic to other pods in the namespace. Therefore, only option C achieves complete egress isolation.

Answer

NetworkPolicy with podSelector: {} and egress: [{to: [{ipBlock: {cidr: 0.0.0.0/0}}]}]

Answer

NetworkPolicy with podSelector: matchLabels: app: compromised and policyTypes: ["Ingress"]

Answer

NetworkPolicy with podSelector: matchLabels: app: compromised and egress: [{to: [{podSelector: {}}]}]

Question 5

Which crictl command lists all running containers on a node?

Accepted Answer

crictl ps. crictl ps lists running containers, similar to docker ps.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats

Question 6

Which TWO of the following are valid audit policy levels in Kubernetes? (Choose two.)

Accepted Answer

RequestResponse. Valid audit levels in Kubernetes are None, Metadata, Request, and RequestResponse. Therefore, the correct answers are A (RequestResponse) and E (Metadata). Options B (Verbose) and C (Response) are not valid audit levels.

Answer

Verbose

Answer

Response

Answer

All

Question 7

Which THREE of the following are recommended steps during incident response for a compromised pod? (Choose three.)

Accepted Answer

Take a memory dump of the container for analysis. Isolating via egress denial, collecting logs/exec output, and taking a memory dump for forensic analysis are appropriate. Restarting pods may destroy evidence, and deleting the namespace is too drastic.

Answer

Delete the entire namespace containing the pod

Answer

Immediately restart the pod to stop the attack

Question 8

Which TWO of the following Falco fields can be used in a rule condition to detect a shell spawned inside a container? (Choose two.)

Accepted Answer

proc.pname. Falco's 'proc.name' matches the process name (e.g., bash, sh). 'container.id' identifies the container. 'evt.type' is for syscall type, not process name. 'k8s.ns.name' is namespace, not shell detection. 'fd.name' is file path.

Answer

evt.type

Answer

k8s.ns.name

Answer

container.id

Question 9

Which TWO of the following are valid audit stages in Kubernetes? (Choose two.)

Accepted Answer

ResponseComplete. Valid audit stages in Kubernetes are RequestReceived, ResponseStarted, ResponseComplete, and Panic. Therefore, the correct answers are ResponseComplete (B) and RequestReceived (C). Options A (ResponseFull) and D (RequestProcessing) are not valid audit stages.

Answer

ResponseFull

Answer

RequestProcessing

Answer

RequestComplete

Question 10

Which THREE of the following are capabilities required for a Falco rule to detect privilege escalation via setuid binary execution? (Choose three.)

Accepted Answer

proc.name in (su, sudo). Falco detects privilege escalation via setuid binary execution by monitoring the 'execve' syscall (option D) to capture process execution events. It then checks if the process name matches known setuid binaries like 'su' or 'sudo' (option B). Additionally, it verifies that the resulting process UID is 0 (root) (option C), indicating privilege escalation. Option A (fd.name contains /dev/tcp) relates to network connections, and option E (evt.type=open) relates to file open events; neither is required for detection of setuid binary execution.

Answer

fd.name contains /dev/tcp

Answer

evt.type=open

Question 11

A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?

Accepted Answer

The `spawned_process` macro may not match because the process was inherited (not spawned), e.g., from an entrypoint. The `spawned_process` macro in Falco specifically matches processes that are created via `execve` or `fork` system calls. If a shell is inherited from the container's entrypoint (e.g., the container runs `bash` as PID 1 directly), it is not considered a spawned process but rather the initial process of the container. Falco's default `spawned_process` macro filters out such inherited processes, so the rule condition fails to match even though `proc.name = bash` is true.

Answer

The rule is missing `proc.name in (bash, sh, zsh)` because only bash is checked

Answer

Falco is not running with the required syscall capabilities

Answer

The priority is set to `ERROR` but the output is being filtered

Question 12

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Accepted Answer

kubectl label pod compromised-pod isolated=true && kubectl apply -f networkpolicy.yaml. The correct approach is to label the pod and apply a deny-all NetworkPolicy that selects pods with that label. This immediately isolates the pod from all network traffic while preserving the pod for forensic analysis. The command sequence is: kubectl label pod compromised-pod isolated=true && kubectl apply -f networkpolicy.yaml where the networkpolicy.yaml defines an ingress/egress deny-all policy for pods with label isolated=true.

Answer

kubectl cordon <node-of-compromised-pod>

Answer

kubectl delete pod compromised-pod && kubectl describe pod compromised-pod

Answer

kubectl exec compromised-pod -- killall miner-process

Question 13

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` is the correct command because it lists running containers managed by the CRI-compatible runtime (e.g., containerd, CRI-O). This is analogous to `docker ps` but for the Kubernetes container runtime interface, allowing you to see container IDs, names, and statuses for debugging.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats

Question 14

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

Accepted Answer

Request. The 'Request' audit level logs the request metadata and the request body, which includes the body of the request. This is exactly what the question asks for. 'RequestResponse' adds the response body, which is not required per the question. Therefore, the correct answer is A.

Answer

None

Answer

RequestResponse

Answer

Metadata

Question 15

During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?

Accepted Answer

kubectl exec -- ps aux. `kubectl exec -- ps aux` runs the `ps aux` command inside the container, which lists running processes. It is the only kubectl command that allows you to inspect container processes. Options A, C, and D do not provide process listings.

Answer

kubectl logs <pod-name>

Answer

kubectl top pod <pod-name>

Answer

kubectl describe pod <pod-name>