CKS Monitoring Logging and Runtime Security — 10 Questions

Question 1

A security team wants to detect anomalous process executions in containers without modifying the container images or requiring agents inside containers. Which approach is most suitable?

Accepted Answer

Deploy Falco as a DaemonSet using eBPF probe to monitor system calls.. Falco, deployed as a DaemonSet with an eBPF probe, can monitor system calls at the kernel level without modifying container images or requiring agents inside containers. This allows it to detect anomalous process executions in real time by analyzing syscall events from the host, which is the most suitable approach for runtime security monitoring in Kubernetes.

Answer

Configure CRI-O to log all container process starts to syslog.

Answer

Enable Kubernetes audit logging and parse the logs for process events.

Answer

Use OPA Gatekeeper to enforce allowed process lists in pod specs.

Question 2

An organization uses Kubernetes with multiple namespaces and wants to ensure that containers running as non-root cannot escalate to root via setuid binaries. Which combination of security contexts and Pod Security Standards achieves this?

Accepted Answer

Apply the 'restricted' Pod Security Standard at the namespace level.. The 'restricted' Pod Security Standard (PSS) enforces the strongest set of security constraints, including preventing containers from running as root and disallowing privilege escalation. Specifically, it requires `securityContext.allowPrivilegeEscalation: false` and prohibits running as root, which directly blocks escalation via setuid binaries. Applying this standard at the namespace level ensures all pods in that namespace inherit these controls, meeting the requirement.

Answer

Use an AppArmor profile to block setuid syscalls.

Answer

Set 'securityContext.runAsUser: 1000' on each pod spec.

Answer

Apply the 'baseline' Pod Security Standard with 'seccompProfile: RuntimeDefault'.

Question 3

A DevOps engineer notices that a container's stdout logs are not appearing in the `kubectl logs` output. The container runs a legacy application that writes logs to a file inside the container. What is the most efficient way to capture these logs without modifying the application?

Accepted Answer

Add a sidecar container that reads the log file and outputs to stdout.. Option B is correct because deploying a sidecar container that tails the log file and writes to its own stdout is the most efficient, Kubernetes-native pattern for capturing logs from applications that write to files. The sidecar container shares the same Pod and volume, reads the log file (e.g., using `tail -F`), and outputs to stdout, which is then collected by `kubectl logs` and the cluster-level logging pipeline. This approach requires no modification to the legacy application and leverages the existing container runtime and kubelet log collection.

Answer

Configure the kubelet to rotate logs from the container's filesystem.

Answer

Use `kubectl cp` to periodically copy logs from the container.

Answer

Install a syslog daemon in the container to forward logs.

Question 4

A security auditor requires that all container images used in the cluster are scanned for vulnerabilities before deployment. The team uses a private registry with image signing. Which solution enforces that only signed and scanned images are deployed?

Accepted Answer

Use Cosign to sign images and deploy a webhook that verifies signatures.. Cosign is a tool for signing container images, and deploying a validating webhook (e.g., the cosigned admission controller) enforces that only images with valid signatures are admitted. This directly meets the requirement to deploy only signed and scanned images, as the webhook verifies the signature before the pod is created.

Answer

Run Trivy in a CronJob to scan images and update a ConfigMap with allowed images.

Answer

Use OPA Gatekeeper to verify that the image comes from the private registry.

Answer

Enable Binary Authorization on the cluster to enforce image attestation.

Question 5

A cluster administrator wants to monitor network traffic between pods for security analysis. Which tool is designed specifically for this purpose and integrates with Kubernetes?

Accepted Answer

Deploy Cilium with Hubble for network flow visibility.. D is correct because Cilium, combined with Hubble, is specifically designed to provide deep network flow visibility and monitoring for Kubernetes pods. Hubble leverages eBPF to capture and report network traffic at the kernel level, offering granular observability into pod-to-pod communications, which directly meets the requirement for security analysis of network traffic between pods.

Answer

Configure Fluentd to collect network logs from each node.

Answer

Use Prometheus to scrape network metrics from kube-proxy.

Answer

Run kube-bench to audit network policies.

Question 6

Which TWO actions are effective for detecting and preventing container breakout attempts using runtime security tools?

Accepted Answer

Deploy Falco with rules that alert on 'syscall' events like 'clone' or 'unshare'.. Option D is correct because Falco is a CNCF runtime security tool that uses eBPF or kernel modules to intercept system calls. By alerting on sensitive syscalls like 'clone' (used to spawn new processes) or 'unshare' (used to create new namespaces), Falco can detect container breakout attempts where an attacker tries to escape the container's isolation. This provides real-time detection of anomalous behavior indicative of a breakout.

Answer

Set 'securityContext.seccompProfile.type: Unconfined' to allow all syscalls.

Answer

Enable Kubernetes audit logging to capture exec commands.

Answer

Use PodSecurityPolicy to deny privileged containers.

Question 7

Which THREE practices help ensure the integrity and confidentiality of container logs in a Kubernetes cluster?

Accepted Answer

Configure the log collector to use TLS when shipping logs to a central system.. Option A is correct because configuring the log collector to use TLS (e.g., Fluentd with TLS output plugin or Filebeat with SSL/TLS) encrypts log data in transit, preventing eavesdropping or tampering during shipping to a central system like Elasticsearch or Splunk. This directly protects confidentiality and integrity against man-in-the-middle attacks on the network path.

Answer

Set container 'stdout' logging only, avoiding file-based logs.

Answer

Disable log rotation to prevent log tampering during rotation.

Question 8

A DevOps team is deploying a new microservice that processes sensitive payment data. The security policy requires that all file system writes outside the /tmp directory be logged and alerted. Which runtime security tool and configuration best achieves this requirement with minimal performance impact?

Accepted Answer

Deploy Falco with a rule: 'evt.type=open and evt.dir=< and fd.name startswith / and not fd.name startswith /tmp'. Option C is correct because Falco is a runtime security tool that monitors system calls in real time. The provided rule specifically triggers an alert when a file is opened for writing (evt.dir=<) outside of /tmp, meeting the logging and alerting requirement with minimal performance impact since it only inspects syscalls without blocking them.

Answer

Use Seccomp profiles to block write syscalls outside /tmp

Answer

Implement an OPA Gatekeeper constraint to reject pods that write outside /tmp

Answer

Configure AppArmor to deny writes outside /tmp

Question 9

A security engineer runs kube-hunter against a production cluster and receives the above output. The cluster uses kubeadm with default settings. Which two actions should the engineer take to remediate the vulnerabilities?

Accepted Answer

Upgrade the cluster to Kubernetes 1.14 or later to fix CVE-2019-11245. Option A is correct because CVE-2019-11245 affects kubelet container runtime exec probes in Kubernetes versions prior to 1.14, where containers could restart unexpectedly due to a race condition. Upgrading to 1.14 or later patches this vulnerability. Option C is correct because setting --anonymous-auth=false on the kubelet disables unauthenticated access to the kubelet API, which is a common finding from kube-hunter when default kubeadm settings leave anonymous authentication enabled.

Answer

Set the kubelet flag --authentication-token-webhook=true

Answer

Enable the NodeRestriction admission controller

Answer

Modify the kube-apiserver manifest to set --anonymous-auth=false

Question 10

An auditor requires that all audit logs from the Kubernetes API server be stored for 90 days and be tamper-proof. Which TWO measures should be implemented?

Accepted Answer

Configure the audit log backend to write to an immutable object store like S3 with Object Lock. Option A is correct because storing audit logs in an immutable object store like S3 with Object Lock ensures tamper-proof retention by preventing any object from being overwritten or deleted for a specified retention period. This directly satisfies the auditor's requirement for logs that cannot be altered or destroyed, regardless of the Kubernetes cluster state.

Answer

Enable the AuditDynamicConfiguration feature gate

Answer

Deploy Fluentd to forward logs to a central Elasticsearch cluster

Answer

Set --audit-log-maxbackup=10 and --audit-log-maxsize=100