Monitoring, Logging and Runtime Security

In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?

To ensure a container's filesystem is read-only, which field should be set to 'true' in the container spec?

Which TWO of the following are valid Falco rule priorities?

In a Falco rule, what does the 'priority' field indicate?

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

You are writing a Falco rule to detect when a container tries to read /etc/shadow. Which condition should you use?

You have configured an audit policy with level: Request. Which request information is logged?

A cluster administrator wants to enforce that containers run with a read-only root filesystem. Which security context field should be set?

During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?

Which TWO of the following are valid audit stages in Kubernetes? (Select 2)

A Falco rule has priority: CRITICAL and condition: evt.type=execve and proc.name!=bash. What does this rule detect?

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Which TWO of the following Falco fields can be used in a rule condition to detect a shell spawned inside a container? (Choose two.)

You need to create a NetworkPolicy that allows only ingress traffic from pods with label 'app: frontend' in the same namespace. Which policyType and ingress rule should you use?

An audit policy is configured with the following rule: - level: RequestResponse users: ["system:serviceaccount:kube-system:admin"] verbs: ["get", "list"] resources: - group: "" resources: ["secrets"] What will be logged when the service account 'admin' in kube-system performs a GET request on a Secret?

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

You need to configure a NetworkPolicy that allows egress traffic only to an external database at IP 10.0.0.5 on port 5432, and denies all other egress. Which policy BEST achieves this?

A cluster runs Kubernetes 1.29 with the AppArmor support enabled. A pod manifest sets securityContext.appArmorProfile.type to Localhost with localhostProfile: k8s-nginx. The pod stays in ContainerCreating and the kubelet logs show a failed to apply AppArmor profile error. Which action most directly resolves the failure?

Which THREE of the following are recommended steps during incident response for a compromised pod? (Choose three.)

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would trigger an alert for such an event?

A security team wants to detect any attempt to read /etc/shadow from within a container using Falco. Which condition in a Falco rule would match this behavior?

Which TWO of the following are valid techniques to detect and respond to runtime incidents in a Kubernetes cluster? (Select TWO.)

You run 'kubectl exec -it <pod> -- /bin/sh' inside a pod that has an immutable root filesystem. What happens?

Which TWO of the following are valid audit levels in a Kubernetes audit policy? (Select TWO.)

A security engineer is hardening a Kubernetes cluster and wants to ensure that any container attempting to load a kernel module is immediately detected and logged. They have deployed Falco on all nodes. Which Falco rule condition should they use to detect this activity?

Which TWO tools can be used to directly interact with the container runtime (without going through the Kubernetes API) for troubleshooting?

Which TWO of the following are valid priority levels in Falco rules?

You are investigating a pod suspected of being compromised. Which set of commands would provide the most useful forensic evidence without altering the container's state?

A cluster uses containerd and a security team wants to block containers from loading kernel modules. They apply a pod with securityContext.seccompProfile.type set to Localhost and a profile that returns SCMP_ACT_ERRNO for the init_module and finit_module syscalls. The pod starts but a test binary still loads a module. Which is the most likely cause?

Which THREE of the following are recommended steps during incident response for a compromised pod?

A security analyst needs to detect and record attempts to modify Kubernetes audit-relevant resources. The cluster already forwards audit logs to a SIEM. Which configuration ensures the API server records both the request and the response for changes to Secrets, while keeping other requests at a lighter level?

You need to detect any unexpected outbound connections from pods in the 'production' namespace. Which Falco rule condition is MOST appropriate?

Which crictl command is used to view logs from a specific container?

A security analyst notices that a Falco rule intended to detect writes to /etc inside containers is generating alerts for a legitimate application that writes to /etc/app/config. The analyst wants to refine the rule to exclude this specific path while still detecting other writes to /etc. Which Falco rule condition modification should be applied?

Which audit policy level logs the request metadata and the request body?

You need to configure Kubernetes audit logging to log all requests at the Metadata level for a specific namespace. Which audit policy level should you use?

Which Kubernetes resource is used to define audit logging configuration?

An incident responder needs to isolate a compromised pod immediately without deleting it. Which action should they take?

Which THREE Falco priority levels sequences are correctly ordered from lowest to highest severity? (Choose three)

Falco detects a shell being opened inside a container. Which Falco rule field is used to specify the syscall condition for detection?

An administrator wants to set an immutable root filesystem for a container in a Pod. Which securityContext field should be set to true?

You need to configure a Kubernetes Pod to have an immutable root filesystem. Which field should you set in the Pod spec?

A developer reports that a pod cannot reach an external database at 192.168.1.100:3306. The pod's namespace is 'app'. You need to create a NetworkPolicy that allows egress to that IP only. Which policy is correct?

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

You want to run crictl to list all running containers on a node. Which command should you execute?

You are investigating a compromised pod. You suspect the attacker used 'kubectl exec' to gain shell access. Which command can you use to check the audit logs for exec events?

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?

An administrator runs 'falco --list' and sees many default rules. What is the correct way to load a custom Falco rules file?

You are investigating a pod that may have been compromised. Which kubectl command allows you to run a shell inside the running container without overwriting the container's filesystem?

Which kubectl command can be used to exec into a running container for forensic analysis during an incident response?

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

Which crictl command is used to view the logs of a specific container in a node?

An audit policy is configured with level: Request. Which operations are recorded in the audit log?

Which crictl command can you use to view the logs of a specific container?

Which THREE of the following are recommended incident response steps when a container is compromised?

During a security incident, you need to isolate a compromised pod named 'malicious-pod' in namespace 'default' to prevent it from communicating with other pods. Which command should you run?

A security admin needs to audit all API requests to the Kubernetes API server. Which audit policy level logs the request body and response body?

A Falco rule is configured to detect privilege escalation via setuid binaries. Which syscall is commonly associated with this activity?

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

An admin runs 'kubectl get pods' and sees a pod in 'CrashLoopBackOff' state. The pod's containers have a restart policy of 'Always'. What is the most likely cause?

You suspect a container is running an unexpected process. Which crictl command can you use to list all running containers on the node?

A Falco rule has the following condition: spawned_process and container and proc.name = bash and proc.pname != sshd. What does this rule detect?

Which THREE of the following are common indicators of a container compromise that Falco can detect? (Select 3)

A pod is stuck in Pending state. You run 'kubectl describe pod' and see the event: '0/3 nodes are available: 3 Insufficient cpu'. What is the likely cause?

You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?

A security team wants to detect any attempt to spawn an interactive shell inside a container. Which Falco rule condition would be appropriate?

Which THREE of the following are effective methods to preserve evidence during a container security incident?

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Which audit stage is logged after the request is fully processed and the response is sent?

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

A pod is running in the 'default' namespace with a container that has an immutable root filesystem (readOnlyRootFilesystem: true). The application writes logs to /var/log/app.log. What will happen?

Which audit policy level logs all requests and responses, including the request body and response body?

Which TWO of the following are valid audit policy levels in Kubernetes? (Choose two.)

You run 'crictl ps' and see a container with state CONTAINER_RUNNING. What does this indicate?

Which THREE of the following are required components to enable audit logging in Kubernetes? (Select three.)

You have a pod that is in CrashLoopBackOff. You want to inspect the logs from the previous instance of the container. Which flag should you use with kubectl logs?

You are configuring Kubernetes audit logging. You want to log all requests to the `secrets` resource in the `kube-system` namespace at the `RequestResponse` level, while logging all other requests at the `Metadata` level. Which audit policy configuration achieves this?

You run 'crictl ps' and see no output, but the node has running pods. What is the most likely cause?

Which crictl command lists all running containers on a node?

Which kubectl command(s) can you use to view the logs of a specific container in a multi-container pod? (Select all that apply)

A Falco rule is triggered when a shell is spawned inside a container. Which syscall is typically used to detect shell execution?

You want to isolate a compromised pod by blocking all network traffic to and from it. Which NetworkPolicy would you apply?

A pod runs with an immutable root filesystem (readOnlyRootFilesystem: true). The application attempts to write to /tmp. What is the expected behavior?

An admin runs 'crictl ps' on a node and sees multiple containers. Which command should they use to view the logs of a specific container?

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

Which kubectl command can be used to execute a shell inside a running container for forensic analysis?

You need to preserve evidence (container logs) from a compromised pod before deleting it. Which command should you run first?

An administrator wants to enable Kubernetes audit logging with the following requirements: log all requests at the Metadata level, but log all responses at the Request level. Which audit policy configuration achieves this?

Which THREE of the following are valid audit stages in Kubernetes audit logging? (Select THREE.)

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

What is the purpose of setting a container's filesystem to read-only in a Pod spec?

A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

You want to ensure that a container's root filesystem is immutable. Which field in the Pod spec should you set?

A CKS candidate is investigating a pod that appears to have been compromised. The incident response team wants to capture the exact system calls made by processes inside the container to understand the attacker's actions. Which Kubernetes-native feature or tool should be used to collect this syscall-level telemetry?

Which crictl command is used to list all running containers managed by the container runtime?

A security team wants to detect attempts to read /etc/shadow inside containers. Which Falco rule condition would trigger on a container reading that file?

Which crictl command is used to view the logs of a specific container?

You need to detect when a container attempts to mount the host's Docker socket. Which Falco macro or condition would you use?

You have deployed a DaemonSet to run a logging agent on every node. After an update, the new pods are stuck in 'Pending' state. You run 'kubectl describe pod ds-pod-xxxxx' and see '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the MOST likely cause?

A pod named 'busybox-pod' is compromised. You want to isolate it from all other pods using a NetworkPolicy. Which YAML snippet correctly denies all ingress and egress traffic to/from the pod?

Which TWO of the following are valid audit stages in Kubernetes? (Choose two.)

A platform team is hardening a namespace that runs tenant workloads. They want runtime detection that flags container escapes and unexpected privilege changes. Which TWO Falco rule fields or conditions are most appropriate to detect these behaviors? (Choose two.)

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Which flag is used when starting kube-apiserver to enable audit logging?

An administrator wants to monitor runtime security events in Kubernetes using Falco. Which component must be deployed as a DaemonSet to capture system calls from containers?

Which TWO of the following are valid methods to detect a container spawning a shell (e.g., /bin/bash) using Falco? (Select two.)

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

Which of the following is NOT a valid priority level in a Falco rule?

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

Which TWO of the following are valid steps to respond to a runtime security incident where a container is suspected to be compromised? (Select two.)

A Falco rule detects unexpected outbound connections. Which condition would identify a connection to an external IP not in the allowed list?

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

Which TWO are valid stages in a Kubernetes audit event? (Select 2)

You are using crictl to debug a container. Which command lists all running containers on the node?

You need to ensure a container's filesystem is immutable at runtime except for a temporary volume. Which Pod spec configuration achieves this?

Which TWO of the following are valid audit stages in Kubernetes audit logging? (Choose two)

An audit policy is configured with the following rule: - level: Metadata resources: - group: "" resources: ["secrets"] What does this rule log for requests to the Secrets API?

You need to configure the Kubernetes API server to enable audit logging at the 'Metadata' level for all requests. Which flag should be used when starting the kube-apiserver?

A pod has securityContext.readOnlyRootFilesystem: true. What happens if a process inside the container tries to write to the root filesystem?

Which TWO tools can be used to directly interact with a container runtime on a Kubernetes node without using kubectl?

Which audit stage in Kubernetes audit logging captures the stage after a request is processed and before a response is sent?

Which kubectl command can be used to view the live logs of a container in a pod named 'my-pod'?

A pod named 'compromised-pod' is suspected of making unauthorized outbound connections. You want to isolate the pod using a NetworkPolicy. Which policy correctly denies all egress traffic from the pod?

Which Falco rule condition would detect an attempt to read the /etc/shadow file in a container?

An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?

Which TWO of the following are true about Kubernetes audit logging?