CKS Monitoring, Logging and Runtime Security Practice Test 7 — 15 Questions

Question 1

A Falco rule has priority: CRITICAL and condition: evt.type=execve and proc.name!=bash. What does this rule detect?

Accepted Answer

All execve events except bash regardless of namespace. The Falco rule `evt.type=execve and proc.name!=bash` with priority CRITICAL detects all `execve` system call events where the process name is NOT `bash`. Falco operates at the host level and monitors all system calls across the entire node, including those from containers. Since the rule does not include a container-specific filter (e.g., `container.id != host`), it applies to all processes regardless of namespace. Therefore, the rule detects all execve events except bash on the entire node—both host and container processes. Option B correctly captures this scope ('regardless of namespace').

Answer

Any process spawning bash

Answer

All execve events inside containers except bash

Answer

All execve events on the host except bash

Question 2

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

Accepted Answer

ResponseComplete. The `ResponseComplete` stage in Kubernetes audit logging captures the moment when the complete HTTP response has been sent to the client. This stage includes the final response body, headers, and status code, providing a full record of what the client actually received. Auditing at this stage is essential for compliance and forensic analysis, as it logs the definitive outcome of the API request.

Answer

ResponseStarted

Answer

Panic

Answer

RequestReceived

Question 3

You run 'crictl ps' and see a container with state CONTAINER_RUNNING. What does this indicate?

Accepted Answer

The container is running normally. In crictl, the state CONTAINER_RUNNING indicates that the container's processes are actively executing and the container is in a normal operational state. This corresponds to the container runtime (e.g., containerd) reporting the container as fully started and not in any transitional or halted state.

Answer

The container has exited

Answer

The container is paused

Answer

The container is starting up

Question 4

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Accepted Answer

Create a NetworkPolicy with podSelector matching the compromised pod and empty ingress/egress rules (deny all). A NetworkPolicy with a `podSelector` matching the compromised pod and empty `ingress` and `egress` rules (i.e., no rules specified) defaults to denying all traffic to and from that pod. This isolates the pod from all other pods in the cluster while preserving its network state for forensics, as the pod remains running and its network interfaces are untouched.

Answer

Deny all ingress and egress traffic to/from the pod's namespace

Answer

Add a label to the pod and create a NetworkPolicy allowing only traffic from a forensic pod

Answer

Delete the pod

Question 5

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

Accepted Answer

evt.type=execve and proc.name in (bash, sh). Detecting a shell inside a container requires monitoring the execution of shell binaries. Falco's `evt.type=execve` captures process execution events, and `proc.name in (bash, sh)` filters for common shell programs. This combination directly identifies when a shell process is started, which is a strong indicator of interactive access or potential compromise.

Answer

evt.type=read and fd.name=/etc/passwd

Answer

evt.type=clone and proc.name=bash

Answer

evt.type=open and fd.name=/bin/bash

Question 6

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

Accepted Answer

Take a snapshot of the container's filesystem. Taking a snapshot of the container filesystem (e.g., using crictl export) and capturing the container logs are standard forensic steps.

Answer

Delete the pod immediately

Answer

Apply a NetworkPolicy to allow all traffic

Answer

Restart the container

Question 7

A security team wants to detect any attempt to spawn an interactive shell inside a container. Which Falco rule condition would be appropriate?

Accepted Answer

container.id != host and evt.type = execve and proc.name = bash. Falco uses syscall events. The condition container.id != host and evt.type = execve and proc.name = bash detects a bash exec in a container, which is a common interactive shell.

Answer

container.id != host and evt.type = read and fd.name = /etc/shadow

Answer

evt.type = connect and container.id != host

Answer

proc.name = bash and evt.type = execve

Question 8

You have configured an audit policy with level: Request. Which request information is logged?

Accepted Answer

Request metadata and request body. In the Kubernetes audit policy, the Request level logs the request metadata (who, what, when, where) plus the request body, but not the response body. This is useful for capturing what was sent to the API server without the overhead of logging responses. The Response level would additionally log the response body.

Answer

Only metadata for the request

Answer

Nothing is logged because Request is not a valid level

Answer

Request metadata, request body, and response body

Question 9

You are investigating a pod suspected of being compromised. Which set of commands would provide the most useful forensic evidence without altering the container's state?

Accepted Answer

kubectl logs && kubectl describe pod . Option A is the only set of commands that does not execute anything inside the container. `kubectl logs` and `kubectl describe pod` read information from the API server and kubelet without interfering with the container's runtime state. Options B, C, and D all involve `kubectl exec` (or `kubectl cp`, which uses `kubectl exec` to run tar inside the container), creating new processes and potentially modifying atime or other state, violating the forensic principle of non-interference.

Answer

kubectl cp :/ -c /tmp/forensic && kubectl logs --previous

Answer

kubectl exec -- cat /proc/1/cmdline && kubectl exec -- ls -la /

Answer

kubectl exec -it -- bash && kubectl exec -- cat /var/log/syslog

Question 10

What is the purpose of setting a container's filesystem to read-only in a Pod spec?

Accepted Answer

To prevent an attacker from modifying the container's filesystem after compromise. Setting a container's filesystem to read-only in a Pod spec (via `securityContext.readOnlyRootFilesystem: true`) ensures that the container's root filesystem cannot be written to at runtime. This is a critical runtime security hardening measure because even if an attacker gains code execution inside the container (e.g., through a web application vulnerability), they cannot modify binaries, configuration files, or scripts on the filesystem, severely limiting their ability to persist, escalate privileges, or tamper with the application. This aligns with the principle of immutable infrastructure and is a key control in the CKS domain of Runtime Security.

Answer

To allow multiple pods to share the same filesystem

Answer

To prevent the container from being deleted

Answer

To improve disk I/O performance

Question 11

Which crictl command can you use to view the logs of a specific container?

Accepted Answer

crictl logs <container-id>. `crictl logs` is the dedicated command to retrieve and display the logs of a specific container managed by a CRI-compatible runtime (e.g., containerd, CRI-O). It works similarly to `docker logs` and reads the container's stdout/stderr streams, which are captured by the container runtime.

Answer

crictl inspect <container-id>

Answer

crictl exec <container-id> cat /var/log/syslog

Answer

crictl ps

Question 12

An admin runs 'kubectl get pods' and sees a pod in 'CrashLoopBackOff' state. The pod's containers have a restart policy of 'Always'. What is the most likely cause?

Accepted Answer

The container's command fails immediately after start. A CrashLoopBackOff state indicates that the container starts, fails, and is repeatedly restarted by kubelet due to the 'Always' restart policy. The most likely cause is that the container's command or entrypoint fails immediately after start (e.g., a non-zero exit code from a misconfigured binary or script), triggering the restart loop. Unlike resource or node-level issues, this is a container-level failure that produces the rapid restart pattern characteristic of CrashLoopBackOff.

Answer

The image pull secret is missing

Answer

The pod's resource requests exceed node capacity

Answer

The node is out of memory

Question 13

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

Accepted Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]. An audit policy rule with resources: groups: [""]; resources: ["secrets"]; level: RequestResponse will log all requests to secrets at the RequestResponse level (metadata + request + response).

Answer

- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]

Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods"]

Answer

- level: Request
  resources:
  - group: ""
    resources: ["secrets"]

Question 14

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

Accepted Answer

Apply a NetworkPolicy that selects the pod and has no egress rules, effectively blocking all outbound traffic. Applying a NetworkPolicy that selects the pod with no egress rules blocks all outbound traffic while leaving the pod running, which is exactly what forensic isolation requires. In Kubernetes, once a pod is selected by a NetworkPolicy with an egress policy type, only explicitly allowed egress is permitted — an empty egress rule set means deny all. This preserves the pod's state and memory for analysis.

Answer

Use kubectl exec to kill the outbound processes inside the container

Answer

Modify the pod's /etc/hosts to block external IPs

Answer

Delete the pod and recreate it with a restrictive NetworkPolicy

Question 15

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

Accepted Answer

sensitive_file_names. Falco has a macro called 'sensitive_file_names' that includes files like /etc/shadow, /etc/passwd, etc. The rule likely uses that macro to match on open syscalls targeting those files.

Answer

shell_procs

Answer

outbound

Answer

binaries