CKS Monitoring, Logging and Runtime Security Practice Test 9 — 15 Questions

Question 1

Which TWO of the following are valid Falco rule priorities?

Accepted Answer

WARNING. Falco priorities include EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG. HIGH and MEDIUM are not valid.

Answer

MEDIUM

Answer

HIGH

Answer

LOW

Question 2

Which TWO of the following are true about Kubernetes audit logging?

Accepted Answer

Audit stages include 'RequestReceived', 'ResponseStarted', 'ResponseComplete', and 'Panic'. Audit policy levels are None, Metadata, Request, RequestResponse. Stages include RequestReceived, ResponseStarted, ResponseComplete, Panic. The audit policy file is specified via --audit-policy-file flag.

Answer

Audit logging can be enabled without restarting the API server

Answer

The 'Request' level logs both request and response bodies

Answer

The 'Metadata' level logs the request body

Question 3

Which TWO crictl commands can be used to inspect a running container?

Accepted Answer

crictl logs <container-id>. crictl logs shows logs, crictl exec runs a command in the container.

Answer

crictl run <image>

Answer

crictl create <pod-config>

Answer

crictl stats <container-id>

Question 4

You suspect a container is running an unexpected process. Which crictl command can you use to list all running containers on the node?

Accepted Answer

crictl ps. crictl ps lists all running containers on the node. crictl pods lists pods, not containers. crictl images lists images. crictl stats shows resource usage.

Answer

crictl stats

Answer

crictl pods

Answer

crictl images

Question 5

Which flag is used when starting kube-apiserver to enable audit logging?

Accepted Answer

--audit-policy-file. The --audit-policy-file flag specifies the path to the audit policy file, which is required to enable audit logging.

Answer

--audit-log-path

Answer

--audit-webhook-config-file

Answer

--feature-gates=Audit=true

Question 6

You are investigating a compromised pod. You need to capture the contents of a file in the container without modifying the container. Which kubectl command should you use?

Accepted Answer

kubectl cp <pod>:/etc/passwd ./passwd. `kubectl cp` copies files from a container to the local filesystem. Although it does execute a process inside the container (typically tar) to perform the copy, it does not alter the file contents and is the standard method for forensic file extraction. In contrast, `kubectl exec` runs an arbitrary command (e.g., cat) that creates a new process, which is more invasive and could interfere with the container's state. Therefore, `kubectl cp` is the preferred choice when minimal modification is required.

Answer

kubectl logs <pod>

Answer

kubectl exec <pod> -- cat /etc/passwd

Answer

kubectl describe pod <pod>

Question 7

A Falco rule triggers on 'Write below etc' and you see an alert about a process writing to /etc/shadow. Which syscall is Falco most likely using to detect this?

Accepted Answer

write. Falco uses system calls to monitor file writes. The 'write' syscall is used when a process writes data to a file. 'open' and 'openat' are used to open files, but the actual write event is captured by 'write'. 'chmod' changes permissions.

Answer

open

Answer

chmod

Answer

openat

Question 8

You want to configure an audit policy to log all requests to the 'secrets' resource with the body at the 'RequestResponse' level. Other resources should be logged at 'Metadata' level. Which audit policy YAML snippet is correct?

Accepted Answer

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
- level: Metadata
  resources:
  - group: ""
    resources: ["*"]. It includes the required apiVersion and kind fields (audit.k8s.io/v1 and Policy) and correctly defines two rules: one for secrets at RequestResponse level with an empty group, and one for all other resources at Metadata level. Option D is incorrect because it omits the apiVersion and kind fields; while the rules structure is valid, a complete audit policy object must include those fields to be applied in Kubernetes. Option A uses 'Body' which is not a valid audit level (must be RequestResponse). Option C uses 'policies' as the top-level key instead of 'rules', which is invalid.

Answer

rules:
- level: Body
  resources: ["secrets"]
- level: Metadata
  resources: ["*"]

Answer

policies:
- level: RequestResponse
  resources: ["secrets"]
- level: Metadata
  resources: ["*"]

Answer

rules:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
- level: Metadata
  resources:
  - group: ""
    resources: ["*"]

Question 9

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: monitoring-pod
  policyTypes:
  - Ingress
  - Egress. It selects the compromised pod, allows ingress only from the monitoring pod (using podSelector), and specifies policyTypes as both Ingress and Egress. Since no egress rules are defined, egress traffic is denied by default, isolating the pod from initiating communication. Option B incorrectly allows all egress via an empty egress rule. Option C denies all ingress (no ingress rules) and thus blocks the monitoring pod. Option D allows all ingress and does not restrict egress, failing to isolate the pod.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  egress:
  - {}
  policyTypes:
  - Egress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  policyTypes:
  - Ingress
  - Egress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  ingress:
  - {}
  policyTypes:
  - Ingress

Question 10

You run 'kubectl exec -it <pod> -- /bin/sh' inside a pod that has an immutable root filesystem. What happens?

Accepted Answer

The shell starts successfully, but any attempt to write to the root filesystem will be denied. An immutable root filesystem (readOnlyRootFilesystem: true) prevents any writes to the container's root filesystem. However, /tmp is often a tmpfs mount that is writable, and /proc is a virtual filesystem. The exec command itself runs a process; it does not write to the filesystem. The shell can still run, but any attempt to write to the root filesystem will fail.

Answer

The command fails with an error because the container has an immutable root filesystem

Answer

The shell starts and can write to any directory because 'exec' bypasses the restriction

Answer

The pod is restarted with a writable filesystem

Question 11

During a security incident, you need to snapshot the processes running inside a container without using kubectl exec. Which crictl command sequence can you use?

Accepted Answer

crictl ps and then crictl exec <container-id> ps aux. crictl ps lists containers, then crictl exec (or crictl exec -i -t) runs a command in a container. However, crictl does not have a 'top' command; you would use ps inside the container. The question asks for a command sequence. Option C is the most direct: list containers, then exec ps aux.

Answer

crictl pods and then crictl ps -a

Answer

crictl images and then crictl run <image>

Answer

crictl ps and then crictl inspect <container-id>

Question 12

Which audit policy level logs all requests and responses, including the request body and response body?

Accepted Answer

RequestResponse. RequestResponse logs both the request object and the response object, including bodies. Request logs only the request object. Metadata logs only metadata. None logs nothing.

Answer

None

Answer

Request

Answer

Metadata

Question 13

A Falco rule has the condition: 'evt.type=open and fd.name contains /etc/shadow and container.id != host'. What is being detected?

Accepted Answer

A container process opening /etc/shadow. The rule detects open syscalls on files whose name contains '/etc/shadow', occurring outside the host (i.e., inside containers). This indicates a container process is opening the shadow file.

Answer

Any process opening /etc/shadow on the host

Answer

A container process writing to /etc/shadow

Answer

A process reading /etc/passwd

Question 14

You want to detect any attempt to run a shell inside a container that is not running as root. Which Falco condition would you use?

Accepted Answer

evt.type=execve and proc.name in (bash, sh) and container.id != host and user.name != root. Ly checks for execve of bash or sh within a container (container.id != host) and ensures the user is not root (user.name != root), which matches the requirement to detect shell execution by non-root users. Option B uses proc.aname (parent process name) instead of proc.name, making it incorrect. Option C omits the user check, so it would flag even root-run shells. Option D checks for user.name = root, which is the opposite of the requirement.

Answer

evt.type=execve and proc.aname in (bash, sh) and container.id != host and user.name != root

Answer

evt.type=execve and proc.name in (bash, sh) and container.id != host

Answer

evt.type=execve and proc.name in (bash, sh) and container.id != host and user.name = root

Question 15

Which kubectl command(s) can you use to view the logs of a specific container in a multi-container pod? (Select all that apply)

Accepted Answer

kubectl logs -c . The `kubectl logs` command allows you to view logs from a specific container in a multi-container pod using the `-c` or `--container` flag. Both `kubectl logs -c ` (option A) and `kubectl logs --container ` (option B) are correct. Option C is incorrect because it omits the flag, and option D shows logs from all containers, not a specific one.

Answer

kubectl logs

Answer

kubectl logs <pod> --all-containers