CKS Monitoring, Logging and Runtime Security Practice Test 3 — 15 Questions

Question 1

A pod named 'busybox-pod' is compromised. You want to isolate it from all other pods using a NetworkPolicy. Which YAML snippet correctly denies all ingress and egress traffic to/from the pod?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: busybox
  policyTypes:
  - Ingress
  - Egress. It uses the correct apiVersion (networking.k8s.io/v1) and explicitly specifies both Ingress and Egress in policyTypes with an empty rules array, which denies all ingress and egress traffic to/from the selected pod. Without any rules, the policy defaults to denying all traffic of the specified types, effectively isolating the pod.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: busybox
  egress:
  - to:
    - podSelector: {}

Answer

apiVersion: v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: busybox
  ingress:
  - from:
    - podSelector: {}

Question 2

An administrator needs to preserve evidence from a compromised container. Which approach is BEST for capturing the container's filesystem and memory for later analysis?

Accepted Answer

Use 'runc checkpoint' to create a checkpoint of the container. `runc checkpoint` uses CRIU to create a full checkpoint of the container, including both memory and filesystem state, making it the best option for forensic evidence. Other options like `kubectl cp` only copy files and do not capture memory, and `crictl save` saves the image, not the running container.

Answer

Use 'crictl export <container-id>' to create a tar archive of the container's filesystem

Answer

Use 'kubectl cp' to copy files from the container to the node

Answer

Use 'crictl save' to save the container image

Question 3

A Falco rule triggers when a shell is spawned inside a container. Which condition correctly identifies bash or sh being executed as the first process (PID 1)?

Accepted Answer

spawned_process and proc.name in (bash, sh) and proc.pid=1. A correct Falco condition should use `spawned_process and container.id != host and proc.name in (bash, sh) and proc.vpid=1`. The macro `spawned_process` filters for execve events, `proc.name` ensures the shell, and `proc.vpid=1` identifies the process as PID 1 in the container's PID namespace. Using `proc.pid` is incorrect because that is the host PID.

Answer

evt.type=execve and proc.name in (bash, sh) and container.id != host

Answer

container.id != host and proc.name in (bash, sh) and proc.ppid=0

Answer

proc.name = bash and proc.pid=1

Question 4

An audit policy is configured with the following rule:
- level: RequestResponse
  users: ["system:serviceaccount:kube-system:admin"]
  verbs: ["get", "list"]
  resources:
  - group: ""
    resources: ["secrets"]
What will be logged when the service account 'admin' in kube-system performs a GET request on a Secret?

Accepted Answer

The request and response metadata and body will be logged. The audit rule specifies `level: RequestResponse`, which instructs the API server to log both the request metadata and body, as well as the response metadata and body, for matching events. The rule matches the service account `system:serviceaccount:kube-system:admin` performing a GET on secrets (empty API group matches core API group), so the full request and response payloads are captured.

Answer

Only the request metadata will be logged

Answer

Only the response will be logged

Answer

Nothing will be logged because the rule uses an empty api group

Question 5

You need to detect any unexpected outbound connections from pods in the 'production' namespace. Which Falco rule condition is MOST appropriate?

Accepted Answer

evt.type=connect and container.id != host and not fd.snet in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"). It uses the `connect` syscall to detect outbound connection attempts from containers (excluding the host) and filters out private IP ranges (RFC 1918 and loopback) to flag only unexpected external destinations. This directly matches the requirement to detect unexpected outbound connections from pods in the 'production' namespace.

Answer

evt.type=sendto and fd.sip != "0.0.0.0"

Answer

container.id != host and evt.type=accept

Answer

proc.name = curl and evt.type=connect

Question 6

A NodePort service is not accessible from outside the cluster. Which command should you use to check if the service's endpoints are correctly populated?

Accepted Answer

kubectl get endpoints . `kubectl get endpoints ` directly shows the IP addresses and ports of the Pods that the Service is routing traffic to. If the endpoints list is empty, the Service has no healthy Pods backing it, which explains why the NodePort is unreachable from outside the cluster. This command is the most direct way to verify that the Service's selector matches running Pods and that the endpoints controller has populated the Endpoints object.

Answer

kubectl get svc <service-name> -o yaml

Answer

kubectl get pods -l <selector>

Answer

kubectl describe service <service-name>

Question 7

To ensure a container's filesystem is read-only, which field should be set to 'true' in the container spec?

Accepted Answer

securityContext.readOnlyRootFilesystem. The securityContext field readOnlyRootFilesystem controls whether the container's root filesystem is read-only. The other options are either non-existent or have different effects.

Answer

securityContext.runAsNonRoot

Answer

container.fsGroup

Answer

podSpec.containers.readonly

Question 8

Which TWO of the following are valid audit stages in Kubernetes audit logging? (Choose two)

Accepted Answer

ResponseStarted. `ResponseStarted` is a valid audit stage in Kubernetes audit logging. It occurs when the response headers are sent, but the response body is not yet complete. This stage is useful for auditing the start of a response, especially for streaming or large responses.

Answer

ResponseFinished

Answer

RequestProcessing

Answer

AuthorizationChecked

Question 9

Which THREE of the following are valid techniques for isolating a compromised pod during incident response? (Choose three)

Accepted Answer

Apply a NetworkPolicy that denies all ingress and egress traffic to the pod. Applying a NetworkPolicy that denies all ingress and egress traffic to the pod effectively isolates it at the network layer, preventing any lateral movement or data exfiltration. This is a standard incident response technique that uses Kubernetes-native network policy rules to create a network-level quarantine without modifying the pod or its image.

Answer

Modify the container image to disable networking

Answer

Delete the pod immediately to stop the threat

Question 10

Which THREE Falco priority levels sequences are correctly ordered from lowest to highest severity? (Choose three)

Accepted Answer

WARNING, ERROR, CRITICAL, ALERT, EMERGENCY. Options A, B, and E are correctly ordered from lowest to highest severity according to Falco's priority levels, which follow the standard syslog severity ordering (RFC 5424). Option A: WARNING, ERROR, CRITICAL, ALERT, EMERGENCY is correct. Option B: DEBUG, INFORMATIONAL, NOTICE, WARNING is correct. Option E: NOTICE, WARNING, ERROR, CRITICAL is correct. Options C and D are incorrectly ordered (C has DEBUG after NOTICE, and D starts with ALERT which is higher than ERROR).

Answer

INFORMATIONAL, NOTICE, DEBUG, WARNING

Answer

ALERT, CRITICAL, ERROR, WARNING

Question 11

An administrator wants to monitor runtime security events in Kubernetes using Falco. Which component must be deployed as a DaemonSet to capture system calls from containers?

Accepted Answer

Falco. Falco is the core userspace component that processes system calls and enforces runtime security rules. It must be deployed as a DaemonSet on each Kubernetes node to capture system calls from all containers running on that node, as it relies on a kernel module or eBPF probe to intercept syscalls at the host level.

Answer

Falco driver

Answer

Kube-bench

Answer

Falcoctl

Question 12

A security team wants to detect attempts to read /etc/shadow inside containers. Which Falco rule condition would trigger on a container reading that file?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. Falco uses system call events to monitor file access. The condition `evt.type=open` captures file open operations, and `fd.name=/etc/shadow` filters for the specific file path. This triggers when any process inside a container opens /etc/shadow for reading, which is a classic indicator of an attempt to access sensitive host data.

Answer

evt.type=connect and fd.name=/etc/shadow

Answer

evt.type=execve and proc.name=cat

Answer

evt.type=open and container.id exists

Question 13

You are investigating a pod that may have been compromised. Which kubectl command allows you to run a shell inside the running container without overwriting the container's filesystem?

Accepted Answer

kubectl exec -it pod-name -- /bin/bash. `kubectl exec -it pod-name -- /bin/bash` attaches an interactive shell to the running container without modifying its filesystem. This command uses the container runtime's exec facility to spawn a new process inside the existing container, leaving the container's root filesystem unchanged. It is the standard method for runtime investigation without altering the container's state.

Answer

kubectl debug pod-name --image=busybox

Answer

kubectl run -it --image=busybox sh

Answer

kubectl attach pod-name

Question 14

An audit policy is configured with level: Request. Which operations are recorded in the audit log?

Accepted Answer

Request metadata and the request body. When an audit policy is configured with `level: Request`, the API server logs the request metadata and the request body for all operations. This is defined in the Kubernetes audit policy specification, where the `Request` level captures the entire request object, including metadata and the body, but does not include the response. This level is useful for debugging and security analysis without the overhead of logging response data.

Answer

Nothing, only the fact that a request occurred

Answer

Request and response metadata and bodies

Answer

Only metadata about the request

Question 15

A cluster administrator wants to enforce that containers run with a read-only root filesystem. Which security context field should be set?

Accepted Answer

readOnlyRootFilesystem: true. The `readOnlyRootFilesystem: true` field in the Pod or container security context explicitly mounts the container's root filesystem as read-only, preventing any writes to the filesystem. This is a key runtime security control to mitigate malware or unauthorized modifications, as required by the CIS Kubernetes Benchmark and common security policies.

Answer

privileged: false

Answer

readOnly: true

Answer

allowPrivilegeEscalation: false