CKS Monitoring Logging and Runtime Security — 20 Questions

Question 1

A security team wants to detect anomalous process executions in containers without modifying the container images or requiring agents inside containers. Which approach is most suitable?

Accepted Answer

Deploy Falco as a DaemonSet using eBPF probe to monitor system calls.. Falco, deployed as a DaemonSet with an eBPF probe, can monitor system calls at the kernel level without modifying container images or requiring agents inside containers. This allows it to detect anomalous process executions in real time by analyzing syscall events from the host, which is the most suitable approach for runtime security monitoring in Kubernetes.

Answer

Configure CRI-O to log all container process starts to syslog.

Answer

Enable Kubernetes audit logging and parse the logs for process events.

Answer

Use OPA Gatekeeper to enforce allowed process lists in pod specs.

Question 2

An organization uses Kubernetes with multiple namespaces and wants to ensure that containers running as non-root cannot escalate to root via setuid binaries. Which combination of security contexts and Pod Security Standards achieves this?

Accepted Answer

Apply the 'restricted' Pod Security Standard at the namespace level.. The 'restricted' Pod Security Standard (PSS) enforces the strongest set of security constraints, including preventing containers from running as root and disallowing privilege escalation. Specifically, it requires `securityContext.allowPrivilegeEscalation: false` and prohibits running as root, which directly blocks escalation via setuid binaries. Applying this standard at the namespace level ensures all pods in that namespace inherit these controls, meeting the requirement.

Answer

Use an AppArmor profile to block setuid syscalls.

Answer

Set 'securityContext.runAsUser: 1000' on each pod spec.

Answer

Apply the 'baseline' Pod Security Standard with 'seccompProfile: RuntimeDefault'.

Question 3

A DevOps engineer notices that a container's stdout logs are not appearing in the `kubectl logs` output. The container runs a legacy application that writes logs to a file inside the container. What is the most efficient way to capture these logs without modifying the application?

Accepted Answer

Add a sidecar container that reads the log file and outputs to stdout.. Option B is correct because deploying a sidecar container that tails the log file and writes to its own stdout is the most efficient, Kubernetes-native pattern for capturing logs from applications that write to files. The sidecar container shares the same Pod and volume, reads the log file (e.g., using `tail -F`), and outputs to stdout, which is then collected by `kubectl logs` and the cluster-level logging pipeline. This approach requires no modification to the legacy application and leverages the existing container runtime and kubelet log collection.

Answer

Configure the kubelet to rotate logs from the container's filesystem.

Answer

Use `kubectl cp` to periodically copy logs from the container.

Answer

Install a syslog daemon in the container to forward logs.

Question 4

A security auditor requires that all container images used in the cluster are scanned for vulnerabilities before deployment. The team uses a private registry with image signing. Which solution enforces that only signed and scanned images are deployed?

Accepted Answer

Use Cosign to sign images and deploy a webhook that verifies signatures.. Cosign is a tool for signing container images, and deploying a validating webhook (e.g., the cosigned admission controller) enforces that only images with valid signatures are admitted. This directly meets the requirement to deploy only signed and scanned images, as the webhook verifies the signature before the pod is created.

Answer

Run Trivy in a CronJob to scan images and update a ConfigMap with allowed images.

Answer

Use OPA Gatekeeper to verify that the image comes from the private registry.

Answer

Enable Binary Authorization on the cluster to enforce image attestation.

Question 5

A cluster administrator wants to monitor network traffic between pods for security analysis. Which tool is designed specifically for this purpose and integrates with Kubernetes?

Accepted Answer

Deploy Cilium with Hubble for network flow visibility.. D is correct because Cilium, combined with Hubble, is specifically designed to provide deep network flow visibility and monitoring for Kubernetes pods. Hubble leverages eBPF to capture and report network traffic at the kernel level, offering granular observability into pod-to-pod communications, which directly meets the requirement for security analysis of network traffic between pods.

Answer

Configure Fluentd to collect network logs from each node.

Answer

Use Prometheus to scrape network metrics from kube-proxy.

Answer

Run kube-bench to audit network policies.

Question 6

Which TWO actions are effective for detecting and preventing container breakout attempts using runtime security tools?

Accepted Answer

Deploy Falco with rules that alert on 'syscall' events like 'clone' or 'unshare'.. Option D is correct because Falco is a CNCF runtime security tool that uses eBPF or kernel modules to intercept system calls. By alerting on sensitive syscalls like 'clone' (used to spawn new processes) or 'unshare' (used to create new namespaces), Falco can detect container breakout attempts where an attacker tries to escape the container's isolation. This provides real-time detection of anomalous behavior indicative of a breakout.

Answer

Set 'securityContext.seccompProfile.type: Unconfined' to allow all syscalls.

Answer

Enable Kubernetes audit logging to capture exec commands.

Answer

Use PodSecurityPolicy to deny privileged containers.

Question 7

Which THREE practices help ensure the integrity and confidentiality of container logs in a Kubernetes cluster?

Accepted Answer

Configure the log collector to use TLS when shipping logs to a central system.. Option A is correct because configuring the log collector to use TLS (e.g., Fluentd with TLS output plugin or Filebeat with SSL/TLS) encrypts log data in transit, preventing eavesdropping or tampering during shipping to a central system like Elasticsearch or Splunk. This directly protects confidentiality and integrity against man-in-the-middle attacks on the network path.

Answer

Set container 'stdout' logging only, avoiding file-based logs.

Answer

Disable log rotation to prevent log tampering during rotation.

Question 8

A DevOps team is deploying a new microservice that processes sensitive payment data. The security policy requires that all file system writes outside the /tmp directory be logged and alerted. Which runtime security tool and configuration best achieves this requirement with minimal performance impact?

Accepted Answer

Deploy Falco with a rule: 'evt.type=open and evt.dir=< and fd.name startswith / and not fd.name startswith /tmp'. Option C is correct because Falco is a runtime security tool that monitors system calls in real time. The provided rule specifically triggers an alert when a file is opened for writing (evt.dir=<) outside of /tmp, meeting the logging and alerting requirement with minimal performance impact since it only inspects syscalls without blocking them.

Answer

Use Seccomp profiles to block write syscalls outside /tmp

Answer

Implement an OPA Gatekeeper constraint to reject pods that write outside /tmp

Answer

Configure AppArmor to deny writes outside /tmp

Question 9

A security engineer runs kube-hunter against a production cluster and receives the above output. The cluster uses kubeadm with default settings. Which two actions should the engineer take to remediate the vulnerabilities?

Accepted Answer

Upgrade the cluster to Kubernetes 1.14 or later to fix CVE-2019-11245. Option A is correct because CVE-2019-11245 affects kubelet container runtime exec probes in Kubernetes versions prior to 1.14, where containers could restart unexpectedly due to a race condition. Upgrading to 1.14 or later patches this vulnerability. Option C is correct because setting --anonymous-auth=false on the kubelet disables unauthenticated access to the kubelet API, which is a common finding from kube-hunter when default kubeadm settings leave anonymous authentication enabled.

Answer

Set the kubelet flag --authentication-token-webhook=true

Answer

Enable the NodeRestriction admission controller

Answer

Modify the kube-apiserver manifest to set --anonymous-auth=false

Question 10

An auditor requires that all audit logs from the Kubernetes API server be stored for 90 days and be tamper-proof. Which TWO measures should be implemented?

Accepted Answer

Configure the audit log backend to write to an immutable object store like S3 with Object Lock. Option A is correct because storing audit logs in an immutable object store like S3 with Object Lock ensures tamper-proof retention by preventing any object from being overwritten or deleted for a specified retention period. This directly satisfies the auditor's requirement for logs that cannot be altered or destroyed, regardless of the Kubernetes cluster state.

Answer

Enable the AuditDynamicConfiguration feature gate

Answer

Deploy Fluentd to forward logs to a central Elasticsearch cluster

Answer

Set --audit-log-maxbackup=10 and --audit-log-maxsize=100

Question 11

You are a security engineer for a financial services company running a Kubernetes cluster with 50 nodes. The cluster uses containerd as the container runtime and Calico for networking. The security team has detected unusual outbound network connections from a pod running in the 'payments' namespace to an external IP address known to be a command-and-control server. The pod is part of a Deployment named 'payment-processor' with 3 replicas. The cluster has a Falco daemonset deployed with default rules, and audit logging is enabled for the API server. You need to quickly identify the compromised container and contain the threat. Which action should you take FIRST?

Accepted Answer

Identify the node hosting the suspicious pod using 'kubectl get pod -o wide', then SSH to that node and use 'crictl ps' to list containers, then 'crictl stop' the container. Option D is correct because it follows the proper incident response workflow for a compromised container: first identify the node hosting the suspicious pod using `kubectl get pod -o wide`, then SSH to that node and use `crictl ps` (the containerd CLI) to list running containers and their IDs, then use `crictl stop` to immediately halt the compromised container. This approach directly isolates the threat at the container runtime level without relying on potentially compromised in-pod tools or deleting the pod (which could be recreated by the Deployment controller).

Answer

Use 'kubectl exec -it <pod> -- bash' to inspect the container, then kill the malicious process from within

Answer

Scale the 'payment-processor' Deployment to 0 replicas to immediately stop all pods

Answer

Check the Falco logs for an alert containing the pod name, then use 'kubectl delete pod' to remove the compromised pod

Question 12

You are auditing a cluster for runtime security best practices. Which TWO of the following actions are recommended to improve container runtime security?

Accepted Answer

Deploy Falco to monitor system calls and detect anomalous behavior.. Falco is a CNCF-graduated runtime security tool that uses eBPF or kernel modules to monitor system calls in real time, detecting anomalous behavior such as unexpected process execution or file writes. Deploying Falco is a recommended best practice for runtime security because it provides deep visibility into container activity without requiring application changes, and it can trigger alerts or actions based on customizable rules.

Answer

Disable the container runtime's security engine to reduce overhead.

Answer

Run containers in privileged mode for better performance.

Answer

Set AppArmor to unconfined for all pods to avoid profile conflicts.

Question 13

A security team deploys the above pod and profile. The pod runs but a security scan reports that mount-related syscalls are being allowed instead of logged. What is the most likely reason?

Accepted Answer

The seccomp profile is not stored in the correct location, so the container runs without seccomp.. Option B is correct because the seccomp profile must be stored in `/var/lib/kubelet/seccomp/` for the `localhost` source to work. If the profile is placed elsewhere, the kubelet cannot read it, and the container runs without any seccomp restriction, allowing mount-related syscalls to proceed instead of being logged or blocked.

Answer

The SYS_ADMIN capability overrides the seccomp policy.

Answer

The defaultAction SCMP_ACT_ALLOW overrides the specific syscalls.

Answer

The profile uses SCMP_ACT_LOG which does not block syscalls; it only logs them.

Question 14

You are responsible for a production Kubernetes cluster running critical workloads. The cluster uses containerd as the container runtime. The security team has deployed Falco with default rules and it is running as a DaemonSet. Recently, the team noticed that several pods have been unexpectedly terminated by the OOMKiller. You suspect a container is performing a fork bomb attack, exhausting memory. You need to detect and prevent such attacks in real-time. Falco is already installed. Which single action should you take to best address this threat?

Accepted Answer

Enable the Falco rule that detects rapid process creation (fork bomb) and configure an alert.. Falco's default rules include a rule for 'Fork Bomb' that detects rapid process creation by monitoring the `clone` and `fork` syscalls. Enabling this rule and configuring an alert allows real-time detection of fork bomb attacks, which is the most direct and effective action to address the threat. This leverages Falco's existing capability to identify anomalous syscall patterns without requiring additional tooling or configuration changes.

Answer

Adjust the OOM score of critical pods to prevent them from being killed.

Answer

Apply a seccomp profile that blocks the fork and clone syscalls.

Answer

Set resource quotas on all namespaces to limit memory usage.

Question 15

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Question 16

Order the steps to recover a Kubernetes cluster after a control plane failure where the API server certificate has expired.

Question 17

Match each Kubernetes command to its function related to security.

Question 18

Match each Kubernetes certificate type to its usage.