CKS Monitoring, Logging and Runtime Security Practice Test 5 — 15 Questions

Question 1

An admin runs 'kubectl get pods' and sees a pod in 'CrashLoopBackOff' state. The pod's containers have a restart policy of 'Always'. What is the most likely cause?

Accepted Answer

The container's command fails immediately after start. A CrashLoopBackOff state indicates that the container starts, fails, and is repeatedly restarted by kubelet due to the 'Always' restart policy. The most likely cause is that the container's command or entrypoint fails immediately after start (e.g., a non-zero exit code from a misconfigured binary or script), triggering the restart loop. Unlike resource or node-level issues, this is a container-level failure that produces the rapid restart pattern characteristic of CrashLoopBackOff.

Answer

The image pull secret is missing

Answer

The pod's resource requests exceed node capacity

Answer

The node is out of memory

Question 2

A developer wants to ensure that a pod can only receive traffic from pods with label 'app: frontend' in the same namespace. Which NetworkPolicy egress rule should be applied to the source pods?

Accepted Answer

Apply an ingress rule on the target pod with 'from' podSelector matching 'app: frontend'. The correct approach is to apply an ingress rule on the target pod, not an egress rule on the source pods. In Kubernetes NetworkPolicy, ingress rules control incoming traffic to the pods selected by the policy. Since the target pod needs to receive traffic only from pods with label 'app: frontend', you define a NetworkPolicy with a podSelector matching the target pod, and an ingress rule that uses a from selector with a podSelector matching 'app: frontend'. This ensures that only pods with that label can send traffic to the target pod. Option D correctly describes this configuration, while options A, B, and C incorrectly apply rules on the wrong pods or use wrong directions.

Answer

Apply an egress rule on the target pod with 'to' podSelector matching 'app: frontend'

Answer

Apply an egress rule on the source pods with 'to' podSelector matching the target pod

Answer

Apply an ingress rule on the source pods with 'from' podSelector matching the target pod

Question 3

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

Accepted Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]. An audit policy rule with resources: groups: [""]; resources: ["secrets"]; level: RequestResponse will log all requests to secrets at the RequestResponse level (metadata + request + response).

Answer

- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]

Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods"]

Answer

- level: Request
  resources:
  - group: ""
    resources: ["secrets"]

Question 4

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

Accepted Answer

Apply a NetworkPolicy that selects the pod and has no egress rules, effectively blocking all outbound traffic. Applying a NetworkPolicy that denies all egress traffic (with no egress rules specified) while targeting the specific pod via podSelector will isolate the pod by blocking all outbound connections. This allows the pod to remain running for forensic analysis. Option B correctly describes this approach.

Answer

Use kubectl exec to kill the outbound processes inside the container

Answer

Modify the pod's /etc/hosts to block external IPs

Answer

Delete the pod and recreate it with a restrictive NetworkPolicy

Question 5

Which flag must be provided to the kube-apiserver to enable audit logging?

Accepted Answer

--audit-policy-file. The --audit-policy-file flag specifies the path to the audit policy file. Without this, audit logging is disabled.

Answer

--enable-admission-plugins

Answer

--authorization-mode

Answer

--audit-log-path

Question 6

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

Accepted Answer

sensitive_file_names. Falco has a macro called 'sensitive_file_names' that includes files like /etc/shadow, /etc/passwd, etc. The rule likely uses that macro to match on open syscalls targeting those files.

Answer

shell_procs

Answer

outbound

Answer

binaries

Question 7

Which THREE of the following are recommended incident response steps when a container is compromised?

Accepted Answer

Copy the container's filesystem using kubectl cp for offline analysis. Isolating the pod via NetworkPolicy, preserving evidence by copying the filesystem, and capturing logs are key steps. Terminating the pod immediately may lose evidence, and ignoring is not recommended.

Answer

Ignore the incident and monitor for further activity

Answer

Immediately terminate the pod to contain the threat

Question 8

Which TWO tools can be used to directly interact with the container runtime (without going through the Kubernetes API) for troubleshooting?

Accepted Answer

ctr. crictl and ctr are CLI tools for interacting with the CRI-compatible container runtime (e.g., containerd). kubectl goes through the API server. docker is not typically used in Kubernetes nodes (unless using Docker as runtime).

Answer

kubelet

Answer

docker

Answer

kubectl

Question 9

Which Falco rule priority is used to indicate a potentially malicious activity that should be investigated?

Accepted Answer

WARNING. Falco rule priorities are: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG. WARNING is used for potentially malicious activities that warrant investigation.

Answer

INFO

Answer

ERROR

Answer

DEBUG

Question 10

You need to configure Kubernetes audit logging to log all requests at the Metadata level for a specific namespace. Which audit policy level should you use?

Accepted Answer

Metadata. Metadata level logs request metadata (user, timestamp, verb, resource) but not the request or response body. It is suitable for logging all requests without exposing sensitive data.

Answer

Request

Answer

None

Answer

RequestResponse

Question 11

A security incident occurred in a pod running in the 'default' namespace. You need to isolate the pod to prevent further damage while preserving evidence. Which set of commands would BEST achieve this?

Accepted Answer

kubectl apply -f networkpolicy.yaml (deny all ingress/egress) && kubectl exec -it pod-name -- bash. Ly isolates the pod by applying a NetworkPolicy that denies all ingress and egress, preventing further damage while the pod remains running for forensic analysis. Then 'kubectl exec' allows collecting evidence. Options A and B do not isolate the pod, and option D deletes the pod, losing evidence.

Answer

kubectl label pod pod-name isolate=true

Answer

kubectl cordon node-name && kubectl drain node-name

Answer

kubectl delete pod pod-name

Question 12

Which crictl command is used to view the logs of a specific container?

Accepted Answer

crictl logs. crictl logs <container-id> displays logs from a container. crictl ps lists containers, crictl exec runs a command in a container, and crictl inspect shows detailed container information.

Answer

crictl ps

Answer

crictl exec

Answer

crictl inspect

Question 13

A Falco rule is triggered when a shell is spawned inside a container. Which syscall is typically used to detect shell execution?

Accepted Answer

execve. Falco detects shell execution by monitoring the `execve` syscall, which is the standard Linux system call used to execute a new program. When a shell like `/bin/bash` or `/sh` is spawned inside a container, the kernel invokes `execve` to replace the current process image with the shell binary. Falco's rule engine matches this syscall against its default rule set (e.g., `run_shell_untrusted`) to trigger an alert.

Answer

clone

Answer

open

Answer

read

Question 14

Which Kubernetes resource can be used to enforce that a container's filesystem is read-only?

Accepted Answer

SecurityContext. The SecurityContext at the container level has a 'readOnlyRootFilesystem' field. When set to true, the container's root filesystem is read-only.

Answer

ResourceQuota

Answer

PodSecurityPolicy

Answer

NetworkPolicy

Question 15

You are investigating a compromised pod. You suspect the attacker used 'kubectl exec' to gain shell access. Which command can you use to check the audit logs for exec events?

Accepted Answer

kubectl get events. The correct command is 'kubectl get events' because when a user executes 'kubectl exec', a Kubernetes event is generated with reason 'Exec' or similar, which can be viewed using 'kubectl get events'. Option A is impractical because audit logs are stored on the control plane node, not inside the pod, and reading them requires host filesystem access, which is not standard. Options C and D are invalid or irrelevant.

Answer

kubectl exec -it pod-name -- cat /var/log/audit/audit.log

Answer

kubectl logs --audit

Answer

kubectl describe pod pod-name