CKS Monitoring, Logging and Runtime Security Practice Question
An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?
⚠ Common exam trap
Candidates often confuse `execve` (which starts the `curl` process) with the actual network syscall (`connect`), thinking that monitoring process execution is sufficient to detect outbound connections, but Falco needs the syscall that establishes the connection itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
connect
The `connect` syscall is invoked when a client initiates an outbound TCP connection, such as when `curl http://example.com` is run inside the container. Falco monitors syscalls at the kernel level, and detecting `connect` allows it to capture the destination IP and port of the outbound request. This is the correct syscall to monitor for outbound network connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
open
Why it's wrong here
The open syscall is used to access filesystem objects, returning a file descriptor that can be read from or written to. While curl may call open to load configuration files, CA certificates, or the executable's shared libraries, the network connection itself is established through socket syscalls on a separate descriptor. Therefore open is unrelated to the actual TCP connection and would not reveal the curl request unless a file operation is being traced.
- ✓
connect
Why this is correct
The connect syscall establishes a connection between a socket and a remote address; for curl, this is the exact moment the TCP handshake begins with the destination web server. When tracing system calls, connect is the first syscall that carries the remote IP and port, so it directly identifies the outbound HTTP request. Thus, of the listed options, connect is the correct syscall to monitor for this network activity.
- ✗
execve
Why it's wrong here
The execve syscall replaces the current process image with a new executable; when the shell runs curl, it forks a child and calls execve to load curl into memory. This only marks the start of the curl process and does not involve any socket operations or network traffic. The actual TCP connection to the remote server is handled by subsequent socket-related syscalls, so execve would not capture the HTTP request itself.
- ✗
bind
Why it's wrong here
The bind syscall attaches a socket to a specific local IP address and port, and it is primarily used for listening sockets in server applications such as nginx or sshd. For an outbound HTTP request, curl does not need to bind explicitly because the kernel automatically assigns an ephemeral source port during the connection setup. Since the question is about an outgoing curl request, bind would not be the syscall that initiates the network connection.
Visual reference
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.