CKS Monitoring, Logging and Runtime Security Practice Test 7 — 15 Questions

Question 1

A cluster has audit logging enabled with a policy that sets 'RequestResponse' level for all resources. The cluster is experiencing high etcd write load. Which change would reduce the load MOST effectively?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the policy level to 'Metadata' for high-volume resources. Changing the audit policy level to 'Metadata' for high-volume resources reduces the amount of data written to the audit log and subsequently to etcd. 'RequestResponse' logs the full request and response body, which is the most verbose level and generates the most data. 'Metadata' logs only request metadata (user, timestamp, resource, verb) without the body, significantly reducing the log volume and thus the etcd write load.

Answer

Add a rule to log 'RequestResponse' only for create and delete operations

Answer

Change the policy level to 'Request' for all resources

Answer

Set the audit log backend to 'webhook' instead of 'log'

Question 2

You want to isolate a compromised pod by blocking all network traffic to and from it. Which NetworkPolicy would you apply?

Accepted Answer

A policy with podSelector matching the pod, and policyTypes: [Ingress, Egress] with no rules. To isolate a compromised pod, you must deny both ingress and egress traffic. Option B applies a NetworkPolicy that selects the pod and specifies both Ingress and Egress policy types without any rules, which results in a default deny-all for both directions, effectively isolating the pod. Option A only blocks ingress, leaving egress unaffected. Option D selects all pods, which would isolate the compromised pod but also impact all other pods unnecessarily. Option C allows all egress, which defeats isolation.

Answer

A policy with podSelector matching the pod, and only ingress rules denying from all

Answer

A policy with podSelector matching the pod, and egress rules allowing to 0.0.0.0/0

Answer

A policy with podSelector: {} and no rules

Question 3

A Falco rule is configured to detect privilege escalation via setuid binaries. Which syscall is commonly associated with this activity?

Accepted Answer

setuid. The setuid syscall is used to change the user ID of the current process, which is a common method for privilege escalation. Falco rules often monitor setuid and setgid syscalls to detect such activity. Option A (connect) is a network syscall. Option C (open) is a file operation syscall. Option D (execve) is used to execute a new program, but the direct privilege escalation is via setuid.

Answer

connect

Answer

open

Answer

execve

Question 4

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the 'RequestResponse' level, but only log requests from the 'kube-system' namespace. Which audit policy rule is correct?

Accepted Answer

- level: RequestResponse
  resources:
  - apiGroup: ""
    resources: ["secrets"]
  namespaces: ["kube-system"]. The correct audit policy rule uses 'apiGroup' for the API group and 'namespaces' to specify the namespace. Option A correctly specifies these fields: 'apiGroup: ""' for the core API group and 'namespaces: ["kube-system"]'. Option B incorrectly uses 'group' instead of 'apiGroup', which is not a valid field. Option C uses 'group' and the singular 'namespace', both incorrect. Option D uses 'group' and the singular 'namespace'. Therefore, only option A is valid.

Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
  namespaces: ["kube-system"]

Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
  namespace: ["kube-system"]

Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
  namespace: ["kube-system"]

Question 5

You are investigating a security incident where a container ran a shell inside a pod. Which Falco rule condition would trigger on a shell spawned in a container?

Accepted Answer

proc.name in (sh, bash). Falco rules use syscalls and process names to detect events. The condition 'proc.name in (sh, bash)' correctly matches processes named 'sh' or 'bash', which are common shells spawned in containers. Option A is incorrect because 'clone' is not the typical syscall for shell execution (execve is used). Option B is incorrect because 'proc.name contains sh' would match any process with 'sh' in its name (e.g., 'sshd'), leading to false positives. Option D is incorrect because 'container.id != host' is unnecessary and 'proc.name = shell' does not match typical shell names like sh or bash.

Answer

evt.type=clone and proc.name = 'shell'

Answer

evt.type=execve and proc.name contains 'sh'

Answer

container.id != host and proc.name = shell

Question 6

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

Accepted Answer

--audit-policy-file=/etc/kubernetes/audit-policy.yaml. Audit-policy-file. This flag specifies the path to the audit policy file, which defines the rules for auditing. The other options are incorrect: --audit-log-path only sets the log file location, not the audit level; --audit-webhook-config-file is for sending audit events to a webhook; and --authorization-mode controls RBAC, not audit logging. To capture requests at RequestResponse level, the audit policy must specify that level, and the --audit-policy-file flag is required.

Answer

--audit-webhook-config-file=/etc/kubernetes/audit-webhook.yaml

Answer

--audit-log-path=/var/log/audit.log

Answer

--authorization-mode=RBAC

Question 7

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

Accepted Answer

Run 'kubectl exec -- tcpdump -i eth0' to capture packets. Running 'kubectl exec -- tcpdump -i eth0' captures packets directly from inside the pod, providing real-time network traffic for investigation. This is the most direct first step. Option A (Falco) is a runtime security tool but not specialized for packet-level network analysis. Option B (NetworkPolicy) would block traffic, not investigate it. Option D (kubectl logs) shows application logs, not network connections.

Answer

Deploy Falco with a rule to detect outbound connections

Answer

Create a NetworkPolicy to deny all egress traffic

Answer

Check the pod's logs using 'kubectl logs <pod>'

Question 8

You need to configure a Kubernetes Pod to have an immutable root filesystem. Which field should you set in the Pod spec?

Accepted Answer

securityContext.readOnlyRootFilesystem: true. Setting `securityContext.readOnlyRootFilesystem: true` in the container's security context makes the container's root filesystem read-only, preventing the container from writing to its own filesystem unless explicitly allowed (e.g., via volume mounts). Option A (`spec.hostPID`) shares the host's PID namespace, not relevant. Option B (`allowPrivilegeEscalation`) controls whether a process can gain more privileges than its parent, not filesystem immutability. Option C (`runAsUser`) sets the user ID for the container, not filesystem permissions. Thus, only D achieves an immutable root filesystem.

Answer

spec.hostPID: true

Answer

securityContext.allowPrivilegeEscalation: false

Answer

securityContext.runAsUser: 1000

Question 9

An incident responder needs to isolate a compromised pod immediately without deleting it. Which action should they take?

Accepted Answer

Apply a NetworkPolicy that denies all traffic to and from the pod's labels. Applying a NetworkPolicy that denies all ingress and egress traffic to the pod isolates it from network communication while preserving the pod for forensic analysis. Option A (modifying labels) may not be sufficient to stop traffic. Option B (deleting the pod) removes evidence. Option D (scaling down) is not immediate and may delete the pod.

Answer

Modify the pod's labels to prevent it from receiving traffic

Answer

Delete the pod to stop its activity

Answer

Scale down the deployment to zero replicas

Question 10

Which crictl command is used to view the logs of a specific container in a node?

Accepted Answer

crictl logs . 'crictl logs ' retrieves the logs of a specific container. Option A is correct. Option B ('crictl exec -it sh') runs a command in a running container, not logs. Option C ('crictl pods') lists pods, not container logs. Option D ('crictl ps -a') lists all containers, but does not show logs.

Answer

crictl exec -it <container-id> sh

Answer

crictl pods

Answer

crictl ps -a

Question 11

In a Falco rule, what does the 'priority' field indicate?

Accepted Answer

The severity level of the event. The priority field in a Falco rule indicates the severity level of the event (e.g., CRITICAL, WARNING). Option A is incorrect because it refers to the syscall filter condition. Option B is wrong because it describes the output message format. Option D is not about the rule name. Therefore, option C is correct.

Answer

The syscall filter condition

Answer

The format of the output message

Answer

The rule name

Question 12

You are writing a Falco rule to detect when a container tries to read /etc/shadow. Which condition should you use?

Accepted Answer

fd.name=/etc/shadow and container.id != host. The correct condition 'fd.name=/etc/shadow and container.id != host' ensures the accessed file is /etc/shadow and the event originates from a container (not the host). Option A correctly includes both conditions. Option B specifies /etc/passwd (wrong file). Option C only checks that it's from a container but does not restrict the file. Option D checks the file but does not exclude host events.

Answer

fd.name=/etc/passwd

Answer

container.id != host

Answer

fd.name=/etc/shadow

Question 13

An audit policy is configured with the following rule:
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]
What does this rule log for requests to the Secrets API?

Accepted Answer

Metadata about the request, excluding the body. The 'Metadata' level logs request metadata (user, timestamp, resource) but not the request or response body. Option A corresponds to the 'RequestResponse' level, which logs both request and response bodies. Option C is incorrect because secrets are not excluded by default; the rule applies to secrets. Option D corresponds to the 'Request' level, which logs the request body only.

Answer

The full request and response body

Answer

Nothing, because secrets are excluded by default

Answer

The request body only

Question 14

Which kubectl command can be used to execute a shell inside a running container for forensic analysis?

Accepted Answer

kubectl exec -it -- /bin/sh. 'kubectl exec -it -- /bin/sh' provides an interactive shell inside a running container, which is useful for forensic analysis. Option A is for deleting pods, option B is for viewing logs, option C is for describing resources, and option D is the correct exec command.

Answer

kubectl delete pod <pod>

Answer

kubectl logs <pod>

Answer

kubectl describe pod <pod>

Question 15

You need to create a NetworkPolicy that allows only ingress traffic from pods with label 'app: frontend' in the same namespace. Which policyType and ingress rule should you use?

Accepted Answer

policyTypes: [Ingress]
ingress:
- from:
  - podSelector:
      matchLabels:
        app: frontend. A NetworkPolicy that restricts ingress traffic to only pods with the label 'app: frontend' in the same namespace must use `policyTypes: [Ingress]` and an `ingress` rule with a `podSelector` that matches that label. The `podSelector` without a `namespaceSelector` implicitly selects pods only within the same namespace as the NetworkPolicy, which satisfies the requirement.

Answer

policyTypes: [Ingress]
ingress:
- from:
  - podSelector: {}

Answer

policyTypes: [Ingress]
ingress:
- from:
  - namespaceSelector: {}

Answer

policyTypes: [Egress]