mediumMultiple Choice
CKS Practice Question: A DevOps team is deploying a new microservice…
A DevOps team is deploying a new microservice that processes sensitive payment data. The security policy requires that all file system writes outside the /tmp directory be logged and alerted. Which runtime security tool and configuration best achieves this requirement with minimal performance impact?
⚠ Common exam trap
CNCF often tests the distinction between runtime monitoring (Falco) and enforcement tools (Seccomp, AppArmor, OPA Gatekeeper), and the trap here is that candidates choose blocking tools (A or D) or admission control (B) instead of the tool that specifically logs and alerts at runtime with minimal performance impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Falco with a rule: 'evt.type=open and evt.dir=< and fd.name startswith / and not fd.name startswith /tmp'
Falco is a runtime security tool that monitors system calls in real time. The provided rule specifically triggers an alert when a file is opened for writing (evt.dir=<) outside of /tmp, meeting the logging and alerting requirement with minimal performance impact since it only inspects syscalls without blocking them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Seccomp profiles to block write syscalls outside /tmp
Why it's wrong here
Seccomp operates at the syscall layer, permitting or denying entire syscalls like open(2) or write(2) process-wide; it cannot evaluate the file path being accessed. A profile that blocks write syscalls would also block writes to /tmp, and there is no seccomp mechanism to condition syscall permission on the path argument. Thus it cannot selectively allow writes only within /tmp.
- ✗
Implement an OPA Gatekeeper constraint to reject pods that write outside /tmp
Why it's wrong here
OPA Gatekeeper enforces policies at admission time by validating the Kubernetes resource manifests, such as container images, capabilities, or volumes; it never sees application runtime behavior. After a pod is running, the Gatekeeper webhook has no visibility into which files the microservice opens, so it cannot reject a pod that writes outside /tmp in real time. This is a fundamental limitation of admission control, not policy expressiveness.
- ✓
Deploy Falco with a rule: 'evt.type=open and evt.dir=< and fd.name startswith / and not fd.name startswith /tmp'
Why this is correct
Falco is a runtime security agent that consumes kernel syscall events, and the rule uses evt.type=open with evt.dir=< (the enter event) to examine every open(2) call, along with fd.name checks to match absolute paths. By filtering fd.name startswith / and not startswith /tmp, it generates an alert only when a process opens a file outside /tmp, which covers writes and reads. This rule is efficient because it relies on Falco's in-kernel driver and has minimal overhead, unlike filesystem auditing or inotify.
- ✗
Configure AppArmor to deny writes outside /tmp
Why it's wrong here
AppArmor can enforce a mandatory access control profile that denies writes to any path outside /tmp using file rules, so it could technically prevent the behavior. However, by default AppArmor does not emit logs for denied operations unless the profile includes explicit audit keywords, meaning you would get no visibility into violations without extra configuration. Since the scenario needs to detect or alert on writes outside /tmp, AppArmor requires significant tuning and does not provide a straightforward monitoring rule like Falco.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.