CKS Monitoring, Logging and Runtime Security Practice Test 4 — 15 Questions

Question 1

An administrator wants to monitor runtime security events in Kubernetes using Falco. Which component must be deployed as a DaemonSet to capture system calls from containers?

Accepted Answer

Falco. Falco runs as a DaemonSet to ensure each node has an instance that can intercept system calls from containers using kernel modules or eBPF.

Answer

Falco driver

Answer

Kube-bench

Answer

Falcoctl

Question 2

A security team wants to detect attempts to read /etc/shadow inside containers. Which Falco rule condition would trigger on a container reading that file?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. Falco's open_read syscall condition with fd.name=/etc/shadow detects attempts to open the file for reading.

Answer

evt.type=connect and fd.name=/etc/shadow

Answer

evt.type=execve and proc.name=cat

Answer

evt.type=open and container.id exists

Question 3

You are investigating a pod that may have been compromised. Which kubectl command allows you to run a shell inside the running container without overwriting the container's filesystem?

Accepted Answer

kubectl exec -it pod-name -- /bin/bash. kubectl exec with -it and -- /bin/bash gives an interactive shell without modifying the container's filesystem.

Answer

kubectl debug pod-name --image=busybox

Answer

kubectl run -it --image=busybox sh

Answer

kubectl attach pod-name

Question 4

An audit policy is configured with level: Request. Which operations are recorded in the audit log?

Accepted Answer

Request metadata and the request body. Request level logs only the request metadata and request object, not the response.

Answer

Nothing, only the fact that a request occurred

Answer

Request and response metadata and bodies

Answer

Only metadata about the request

Question 5

A cluster administrator wants to enforce that containers run with a read-only root filesystem. Which security context field should be set?

Accepted Answer

readOnlyRootFilesystem: true. readOnlyRootFilesystem: true makes the container's root filesystem read-only.

Answer

privileged: false

Answer

readOnly: true

Answer

allowPrivilegeEscalation: false

Question 6

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

Accepted Answer

crictl exec. crictl exec allows running commands inside a container using the container runtime interface.

Answer

kubectl port-forward

Answer

falco

Answer

kubectl logs

Question 7

A Falco rule has priority: CRITICAL and condition: evt.type=execve and proc.name!=bash. What does this rule detect?

Accepted Answer

All execve events on the host except bash. It triggers on execve syscalls where the process name is not bash, but the condition doesn't specify container context, so it may fire on host processes as well.

Answer

Any process spawning bash

Answer

All execve events except bash regardless of namespace

Answer

All execve events inside containers except bash

Question 8

You need to configure Kubernetes audit logging to log all requests at the Metadata level except for requests to the 'kube-system' namespace, which should be logged at Request level. How should you structure the audit policy?

Accepted Answer

Default level Metadata with a rule that has 'level: Request' and 'namespaces: [kube-system]'. The policy defines rules with levels and optional namespaces. Rules are evaluated in order; the first matching rule applies.

Answer

Use two rules with 'level: Request' and 'level: Metadata' without default

Answer

Default level Request with a rule for kube-system at Metadata

Answer

Default level Metadata with a rule for kube-system at Request

Question 9

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

Accepted Answer

ResponseComplete. ResponseComplete is the stage after the response has been sent.

Answer

ResponseStarted

Answer

Panic

Answer

RequestReceived

Question 10

You run 'crictl ps' and see a container with state CONTAINER_RUNNING. What does this indicate?

Accepted Answer

The container is running normally. crictl ps shows containers managed by the runtime; CONTAINER_RUNNING means the container is actively running.

Answer

The container has exited

Answer

The container is paused

Answer

The container is starting up

Question 11

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Accepted Answer

Create a NetworkPolicy with podSelector matching the compromised pod and empty ingress/egress rules (deny all). A NetworkPolicy with podSelector matching the compromised pod and ingress/egress rules that deny all traffic except to specific endpoints needed for investigation.

Answer

Deny all ingress and egress traffic to/from the pod's namespace

Answer

Add a label to the pod and create a NetworkPolicy allowing only traffic from a forensic pod

Answer

Delete the pod

Question 12

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

Accepted Answer

evt.type=execve and proc.name in (bash, sh). Falco's 'spawned_process' macro or condition evt.type=execve and proc.name in (bash, sh, zsh, etc.) can detect shell execution.

Answer

evt.type=read and fd.name=/etc/passwd

Answer

evt.type=clone and proc.name=bash

Answer

evt.type=open and fd.name=/bin/bash

Question 13

Which TWO of the following are valid Falco output fields?

Accepted Answer

%evt.type. Falco output fields include %evt.type, %proc.name, %container.id, %fd.name etc.

Answer

%pod.name

Answer

%fd.name

Answer

%k8s.ns

Question 14

Which THREE stages can be configured for Kubernetes audit logging?

Accepted Answer

ResponseComplete. The audit stages are RequestReceived, ResponseStarted, ResponseComplete, and Panic.

Answer

RequestProcessed

Answer

Panic

Question 15

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

Accepted Answer

Take a snapshot of the container's filesystem. Taking a snapshot of the container filesystem (e.g., using crictl export) and capturing the container logs are standard forensic steps.

Answer

Delete the pod immediately

Answer

Apply a NetworkPolicy to allow all traffic

Answer

Restart the container