CKS Monitoring, Logging and Runtime Security Practice Test 8 — 15 Questions

Question 1

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Accepted Answer

crictl is not configured to connect to the correct container runtime socket. crictl is a CLI for CRI-compatible container runtimes. It connects to a specific socket file (e.g., /run/containerd/containerd.sock for containerd, or /var/run/dockershim.sock for older Docker). If the socket path is misconfigured or the runtime is different (e.g., using a non-CRI runtime or a different socket), crictl will show no containers. Meanwhile, kubectl communicates with the kubelet, which directly interacts with the runtime, so pods appear running. Option A is correct. Option B is incorrect because images are pulled before containers start, and if they weren't, crictl might still show the container runtime state. Option C is incorrect because crictl shows all containers on the node, not namespaced. Option D is incorrect because if kubelet were not running, kubectl would also show no pods.

Answer

The images have not been pulled yet

Answer

The containers are running in a different namespace

Answer

The kubelet is not running

Question 2

Which THREE of the following are effective methods to preserve evidence during a container security incident?

Accepted Answer

Take a memory dump of the container. Taking a memory dump of the container captures volatile data (processes, network connections, encryption keys) that is lost when the container stops. This preserves runtime evidence critical for forensic analysis, as memory artifacts are not persisted to disk and must be collected before the container is terminated.

Answer

Delete the pod immediately

Answer

Run kubectl exec to explore and modify files

Question 3

Which TWO of the following are valid priority levels in Falco rules?

Accepted Answer

WARNING. Falco priority levels include EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG. Options A (MEDIUM) and B (LOW) are not standard priority levels; the correct equivalents are NOTICE or INFO for LOW, and WARNING or NOTICE for MEDIUM. Option D (HIGH) is not a standard priority; the correct term is CRITICAL (Option E) or ALERT. Therefore, the correct answers are C (WARNING) and E (CRITICAL).

Answer

MEDIUM

Answer

LOW

Answer

HIGH

Question 4

A security admin needs to audit all API requests to the Kubernetes API server. Which audit policy level logs the request body and response body?

Accepted Answer

RequestResponse. The RequestResponse audit level logs both the request body and response body of API requests. Metadata only logs metadata without bodies, Request logs only the request body, and None disables audit logging. This aligns with Kubernetes audit policy levels.

Answer

Request

Answer

None

Answer

Metadata

Question 5

Falco detects a shell being opened inside a container. Which Falco rule field is used to specify the syscall condition for detection?

Accepted Answer

condition. In Falco, the `condition` field within a rule defines the specific syscall or event filter that triggers the rule. For detecting a shell being opened inside a container, the condition would include a syscall like `execve` or `clone` combined with container context filters such as `container.id != host`. This field is where you specify the exact syscall and its parameters (e.g., `evt.type=execve and proc.name in (bash, sh, zsh)`), making it the correct answer.

Answer

priority

Answer

output

Answer

rule

Question 6

A container has been compromised. You need to isolate it by denying all network traffic. Which NetworkPolicy manifest achieves this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: compromised
  policyTypes:
  - Ingress
  - Egress. Option A creates a NetworkPolicy with only an empty ingress rule and no explicit policyTypes. Because no policyTypes are specified, the default policyTypes become ["Ingress"]. This blocks all incoming traffic but allows all outgoing traffic, failing to isolate the pod. Option B allows all ingress from any pod, which does not isolate. Option C allows all egress to any pod, which does not isolate. Option D explicitly sets policyTypes to both Ingress and Egress without any rules, effectively denying all traffic in both directions, achieving the required isolation.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: compromised
  ingress: []

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: compromised
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector: {}

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: compromised
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector: {}

Question 7

An administrator wants to set an immutable root filesystem for a container in a Pod. Which securityContext field should be set to true?

Accepted Answer

readOnlyRootFilesystem. The 'readOnlyRootFilesystem' field, when true, mounts the container's root filesystem as read-only, preventing writes.

Answer

allowPrivilegeEscalation

Answer

runAsNonRoot

Answer

privileged

Question 8

You need to detect any attempt to read /etc/shadow inside a container using Falco. Which macro would you use in the condition?

Accepted Answer

open_read and fd.name=/etc/shadow. The 'open_read' macro matches open syscalls with read access. The 'fd.name' field matches the file path. Combining them detects reads to /etc/shadow.

Answer

open_write and fd.name=/etc/shadow

Answer

syscall.type=open and fd.name=/etc/shadow

Answer

spawned_process and proc.name=cat

Question 9

Which crictl command is used to list all running containers managed by the container runtime?

Accepted Answer

crictl ps. crictl ps lists containers, similar to docker ps.

Answer

crictl images

Answer

crictl stats

Answer

crictl pods

Question 10

You suspect a container has been compromised and want to perform forensics using kubectl exec. Which command safely collects the container's process list without affecting the container?

Accepted Answer

kubectl exec <pod> -- ps aux. kubectl exec with -- ps aux runs the ps command inside the container, capturing processes without altering the container state.

Answer

kubectl attach <pod>

Answer

kubectl cp /proc <pod>:/tmp

Answer

kubectl exec -it <pod> -- /bin/sh

Question 11

A pod is stuck in Pending state. You run 'kubectl describe pod' and see the event: '0/3 nodes are available: 3 Insufficient cpu'. What is the likely cause?

Accepted Answer

The pod's CPU request exceeds the available CPU capacity on all nodes. The event '0/3 nodes are available: 3 Insufficient cpu' directly indicates that the scheduler attempted to place the pod on each of the three nodes but found that none had enough allocatable CPU to satisfy the pod's CPU request. This means the sum of CPU requests across all pods on each node, plus the new pod's request, exceeds the node's capacity. The pod remains in Pending state because no node can accommodate its resource requirements.

Answer

The pod's image pull policy is set to Always and the registry is unreachable

Answer

The cluster has a taint that the pod does not tolerate

Answer

The scheduler is misconfigured and not running

Question 12

Which audit stage is logged after the request is fully processed and the response is sent?

Accepted Answer

ResponseComplete. Audit stages are: RequestReceived, ResponseStarted, ResponseComplete, and Panic. ResponseComplete occurs after the response is sent.

Answer

Panic

Answer

ResponseStarted

Answer

RequestReceived

Question 13

A Falco rule detects unexpected outbound connections. Which condition would identify a connection to an external IP not in the allowed list?

Accepted Answer

evt.type=connect and fd.ip not in (allowed_ips). The evt.type=connect and fd.ip checks the destination IP; combined with a not in list condition detects unexpected outbound connections.

Answer

evt.type=accept and fd.ip not in (allowed_ips)

Answer

evt.type=listen and fd.ip not in (allowed_ips)

Answer

evt.type=bind and fd.ip not in (allowed_ips)

Question 14

You need to ensure a container's filesystem is immutable at runtime except for a temporary volume. Which Pod spec configuration achieves this?

Accepted Answer

containers:
- name: app
  securityContext:
    readOnlyRootFilesystem: true
  volumeMounts:
  - mountPath: /tmp
    name: scratch
volumes:
- name: scratch
  emptyDir: {}. Setting `readOnlyRootFilesystem: true` in the container's securityContext makes the container's filesystem immutable at runtime, preventing any writes to the root filesystem. By mounting an `emptyDir` volume at `/tmp`, the container gets a writable temporary volume for scratch data, satisfying the requirement of a temporary writable area while keeping the rest of the filesystem read-only.

Answer

containers:
- name: app
  securityContext:
    runAsNonRoot: true
  volumeMounts:
  - mountPath: /tmp
    name: scratch
volumes:
- name: scratch
  emptyDir: {}

Answer

containers:
- name: app
  securityContext:
    readOnlyRootFilesystem: false

Answer

containers:
- name: app
  securityContext:
    readOnlyRootFilesystem: true
  volumeMounts:
  - mountPath: /tmp
    name: scratch
volumes:
- name: scratch
  hostPath:
    path: /tmp

Question 15

You want to preserve evidence from a compromised pod. Which command should you use to copy the entire container filesystem to a safe location?

Accepted Answer

kubectl cp <pod>:/ /tmp/evidence. kubectl cp is the standard and recommended method for copying files from a pod to the local machine, as it reliably preserves file metadata and structure. Option C uses a tar pipeline with a local redirect, which does write the archive to the local machine (not inside the container), making it a possible alternative. However, it is not the preferred approach for forensic evidence because tar may not capture all metadata (e.g., extended attributes) and the process can be slower or less atomic. Therefore, kubectl cp remains the best choice.

Answer

crictl export <container-id> /tmp/evidence.tar

Answer

kubectl exec <pod> -- tar czf - / > /tmp/evidence.tar.gz

Answer

kubectl logs <pod> > /tmp/evidence.log