During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?
Correct. `kubectl exec <pod-name> -- ps aux` executes the `ps aux` command inside the container, displaying all active processes. This is the appropriate kubectl command to check for a reverse shell without requiring node-level access.
Why this answer
`kubectl exec <pod-name> -- ps aux` runs the `ps aux` command inside the container, which lists running processes. It is the only kubectl command that allows you to inspect container processes. Options A, C, and D do not provide process listings.
Exam trap
The exam may test that `kubectl exec` is the kubectl command used to run commands inside a container, enabling process inspection.
How to eliminate wrong answers
Option A is wrong because `kubectl logs` only retrieves the container's stdout/stderr logs, not a list of running processes; it cannot reveal a reverse shell that may not produce log output. Option C is wrong because `kubectl top pod` shows CPU and memory usage metrics for the pod, not process listings; it cannot identify specific processes like a reverse shell. Option D is wrong because `kubectl describe pod` provides metadata, events, and configuration details about the pod, not the container's running processes; it cannot inspect runtime process activity.