CKS Monitoring, Logging and Runtime Security Practice Test 4 — 15 Questions

Question 1

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

Accepted Answer

crictl exec. `crictl exec` allows you to run commands inside a container managed by CRI-compatible runtimes (like containerd), enabling you to inspect network connections from within the container using tools like `ss`, `netstat`, or `ip`. This is the direct method to check outbound connections from the container's network namespace, which is isolated from the host.

Answer

kubectl port-forward

Answer

falco

Answer

kubectl logs

Question 2

A Falco rule has priority: CRITICAL and condition: evt.type=execve and proc.name!=bash. What does this rule detect?

Accepted Answer

All execve events except bash regardless of namespace. The Falco rule `evt.type=execve and proc.name!=bash` with priority CRITICAL detects all `execve` system call events where the process name is NOT `bash`. Falco operates at the host level and monitors all system calls across the entire node, including those from containers. Since the rule does not include a container-specific filter (e.g., `container.id != host`), it applies to all processes regardless of namespace. Therefore, the rule detects all execve events except bash on the entire node—both host and container processes. Option B correctly captures this scope ('regardless of namespace').

Answer

Any process spawning bash

Answer

All execve events inside containers except bash

Answer

All execve events on the host except bash

Question 3

You need to configure Kubernetes audit logging to log all requests at the Metadata level except for requests to the 'kube-system' namespace, which should be logged at Request level. How should you structure the audit policy?

Accepted Answer

Default level Metadata with a rule that has 'level: Request' and 'namespaces: [kube-system]'. In Kubernetes audit policy, the default level applies to requests that match no rule. Setting default: Metadata and a rule for kube-system with level: Request correctly achieves the requirement. This configuration is described in both A and D, making both correct.

Answer

Use two rules with 'level: Request' and 'level: Metadata' without default

Answer

Default level Request with a rule for kube-system at Metadata

Question 4

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

Accepted Answer

ResponseComplete. The `ResponseComplete` stage in Kubernetes audit logging captures the moment when the complete HTTP response has been sent to the client. This stage includes the final response body, headers, and status code, providing a full record of what the client actually received. Auditing at this stage is essential for compliance and forensic analysis, as it logs the definitive outcome of the API request.

Answer

ResponseStarted

Answer

Panic

Answer

RequestReceived

Question 5

You run 'crictl ps' and see a container with state CONTAINER_RUNNING. What does this indicate?

Accepted Answer

The container is running normally. In crictl, the state CONTAINER_RUNNING indicates that the container's processes are actively executing and the container is in a normal operational state. This corresponds to the container runtime (e.g., containerd) reporting the container as fully started and not in any transitional or halted state.

Answer

The container has exited

Answer

The container is paused

Answer

The container is starting up

Question 6

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Accepted Answer

Create a NetworkPolicy with podSelector matching the compromised pod and empty ingress/egress rules (deny all). A NetworkPolicy with a `podSelector` matching the compromised pod and empty `ingress` and `egress` rules (i.e., no rules specified) defaults to denying all traffic to and from that pod. This isolates the pod from all other pods in the cluster while preserving its network state for forensics, as the pod remains running and its network interfaces are untouched.

Answer

Deny all ingress and egress traffic to/from the pod's namespace

Answer

Add a label to the pod and create a NetworkPolicy allowing only traffic from a forensic pod

Answer

Delete the pod

Question 7

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

Accepted Answer

evt.type=execve and proc.name in (bash, sh). Detecting a shell inside a container requires monitoring the execution of shell binaries. Falco's `evt.type=execve` captures process execution events, and `proc.name in (bash, sh)` filters for common shell programs. This combination directly identifies when a shell process is started, which is a strong indicator of interactive access or potential compromise.

Answer

evt.type=read and fd.name=/etc/passwd

Answer

evt.type=clone and proc.name=bash

Answer

evt.type=open and fd.name=/bin/bash

Question 8

Which TWO of the following are valid Falco output fields?

Accepted Answer

%evt.type. `%evt.type` is a valid Falco output field that refers to the event type (e.g., 'open', 'execve', 'connect'). Falco uses this field in its rule conditions and output format strings to identify the specific system call or event that triggered the alert. It is a core field defined in the Falco event schema.

Answer

%pod.name

Answer

%fd.name

Answer

%k8s.ns

Question 9

Which THREE stages can be configured for Kubernetes audit logging?

Accepted Answer

ResponseComplete. Kubernetes audit logging defines four stages: RequestReceived, ResponseStarted, ResponseComplete, and Panic. Therefore, options B, C, D, and E are all valid. Since the question explicitly asks for three stages, it is flawed; the correct set of all valid options is B, C, D, E.

Answer

RequestProcessed

Question 10

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

Accepted Answer

Take a snapshot of the container's filesystem. Taking a snapshot of the container filesystem (e.g., using crictl export) and capturing the container logs are standard forensic steps.

Answer

Delete the pod immediately

Answer

Apply a NetworkPolicy to allow all traffic

Answer

Restart the container

Question 11

A security team wants to detect any attempt to spawn an interactive shell inside a container. Which Falco rule condition would be appropriate?

Accepted Answer

container.id != host and evt.type = execve and proc.name = bash. Falco uses syscall events. The condition container.id != host and evt.type = execve and proc.name = bash detects a bash exec in a container, which is a common interactive shell.

Answer

container.id != host and evt.type = read and fd.name = /etc/shadow

Answer

evt.type = connect and container.id != host

Answer

proc.name = bash and evt.type = execve

Question 12

You have configured an audit policy with level: Request. Which request information is logged?

Accepted Answer

Request metadata and request body. The Request level logs request metadata and request body. This is more detailed than Metadata but less than RequestResponse.

Answer

Only metadata for the request

Answer

Nothing is logged because Request is not a valid level

Answer

Request metadata, request body, and response body

Question 13

You are investigating a pod suspected of being compromised. Which set of commands would provide the most useful forensic evidence without altering the container's state?

Accepted Answer

kubectl logs && kubectl describe pod . Option A is the only set of commands that does not execute anything inside the container. `kubectl logs` and `kubectl describe pod` read information from the API server and kubelet without interfering with the container's runtime state. Options B, C, and D all involve `kubectl exec` (or `kubectl cp`, which uses `kubectl exec` to run tar inside the container), creating new processes and potentially modifying atime or other state, violating the forensic principle of non-interference.

Answer

kubectl cp :/ -c /tmp/forensic && kubectl logs --previous

Answer

kubectl exec -- cat /proc/1/cmdline && kubectl exec -- ls -la /

Answer

kubectl exec -it -- bash && kubectl exec -- cat /var/log/syslog

Question 14

Which crictl command can you use to view the logs of a specific container?

Accepted Answer

crictl logs <container-id>. `crictl logs` is the dedicated command to retrieve and display the logs of a specific container managed by a CRI-compatible runtime (e.g., containerd, CRI-O). It works similarly to `docker logs` and reads the container's stdout/stderr streams, which are captured by the container runtime.

Answer

crictl inspect <container-id>

Answer

crictl exec <container-id> cat /var/log/syslog

Answer

crictl ps

Question 15

You are writing a Falco rule to detect privilege escalation via setuid binaries. Which syscall should the rule monitor?

Accepted Answer

setuid. setuid and setgid syscalls are used to change user/group identity, which can be used for privilege escalation. Falco can monitor these syscalls to detect unauthorized attempts.

Answer

open

Answer

execve

Answer

connect