CCNA Monitoring, Logging and Runtime Security Questions

In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?

To ensure a container's filesystem is read-only, which field should be set to 'true' in the container spec?

You need to configure audit logging for the Kubernetes API server to log all requests at the Metadata level. Which flag and value should you set in the kube-apiserver configuration?

Which TWO of the following are valid Falco rule priorities?

Which TWO of the following are valid audit stages in Kubernetes audit logging?

In a Falco rule, what does the 'priority' field indicate?

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

You are investigating a pod that is suspected of being compromised. You need to preserve the container's filesystem for forensic analysis. Which `crictl` command should you use to export the container's filesystem as a tar archive?

You are writing a Falco rule to detect when a container tries to read /etc/shadow. Which condition should you use?

You have configured an audit policy with level: Request. Which request information is logged?

A cluster administrator wants to enforce that containers run with a read-only root filesystem. Which security context field should be set?

During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes from the node level without entering the container?

Which TWO of the following are valid audit stages in Kubernetes? (Select 2)

A Falco rule has priority: CRITICAL and condition: evt.type=execve and proc.name!=bash. What does this rule detect?

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Which TWO of the following Falco fields can be used in a rule condition to detect a shell spawned inside a container? (Choose two.)

You need to create a NetworkPolicy that allows only ingress traffic from pods with label 'app: frontend' in the same namespace. Which policyType and ingress rule should you use?

An audit policy is configured with the following rule: - level: RequestResponse users: ["system:serviceaccount:kube-system:admin"] verbs: ["get", "list"] resources: - group: "" resources: ["secrets"] What will be logged when the service account 'admin' in kube-system performs a GET request on a Secret?

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

You need to configure a NetworkPolicy that allows egress traffic only to an external database at IP 10.0.0.5 on port 5432, and denies all other egress. Which policy BEST achieves this?

Which THREE of the following are recommended steps during incident response for a compromised pod? (Choose three.)

A Falco rule triggers on 'Write below etc' and you see an alert about a process writing to /etc/shadow. Which syscall is Falco most likely using to detect this?

You want to configure an audit policy to log all requests to the 'secrets' resource with the body at the 'RequestResponse' level. Other resources should be logged at 'Metadata' level. Which audit policy YAML snippet is correct?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would trigger an alert for such an event?

A security team wants to detect any attempt to read /etc/shadow from within a container using Falco. Which condition in a Falco rule would match this behavior?

Which TWO of the following are valid techniques to detect and respond to runtime incidents in a Kubernetes cluster? (Select TWO.)

Which Falco rule priority is used to indicate a potentially malicious activity that should be investigated?

You run 'kubectl exec -it <pod> -- /bin/sh' inside a pod that has an immutable root filesystem. What happens?

You need to detect any attempt to read /etc/shadow inside a container using Falco. Which macro would you use in the condition?

Which TWO of the following are valid audit levels in a Kubernetes audit policy? (Select TWO.)

A cluster has audit logging enabled with a policy that sets 'RequestResponse' level for all resources. The cluster is experiencing high etcd write load. Which change would reduce the load MOST effectively?

Which TWO tools can be used to directly interact with the container runtime (without going through the Kubernetes API) for troubleshooting?

Which TWO of the following are valid priority levels in Falco rules?

You are investigating a pod suspected of being compromised. Which set of commands would provide the most useful forensic evidence without altering the container's state?

Which THREE of the following are recommended steps during incident response for a compromised pod?

A security incident occurred in a pod running in the 'default' namespace. You need to isolate the pod to prevent further damage while preserving evidence. Which set of commands would BEST achieve this?

You need to detect any unexpected outbound connections from pods in the 'production' namespace. Which Falco rule condition is MOST appropriate?

Which crictl command is used to view logs from a specific container?

A security engineer wants to detect any attempt to spawn a shell inside a container. Which Falco rule condition would trigger on a shell being spawned in a container (e.g., /bin/bash or /bin/sh)?

Which audit policy level logs the request metadata and the request body?

You need to configure Kubernetes audit logging to log all requests at the Metadata level for a specific namespace. Which audit policy level should you use?

Which Kubernetes resource is used to define audit logging configuration?

An incident responder needs to isolate a compromised pod immediately without deleting it. Which action should they take?

Which TWO Falco priority levels are correctly ordered from lowest to highest severity? (Choose two correct sequences)

Falco detects a shell being opened inside a container. Which Falco rule field is used to specify the syscall condition for detection?

An administrator wants to set an immutable root filesystem for a container in a Pod. Which securityContext field should be set to true?

You need to enable Kubernetes audit logging with the following requirements: log all requests at the 'RequestResponse' level, but only for successful responses. Which audit stage should you specify in the policy?

You need to configure a Kubernetes Pod to have an immutable root filesystem. Which field should you set in the Pod spec?

A developer reports that a pod cannot reach an external database at 192.168.1.100:3306. The pod's namespace is 'app'. You need to create a NetworkPolicy that allows egress to that IP only. Which policy is correct?

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

You want to run crictl to list all running containers on a node. Which command should you execute?

You are investigating a compromised pod. You suspect the attacker used 'kubectl exec' to gain shell access. Which command can you use to check the audit logs for exec events?

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?

An administrator runs 'falco --list' and sees many default rules. What is the correct way to load a custom Falco rules file?

You are investigating a pod that may have been compromised. Which kubectl command allows you to run a shell inside the running container without overwriting the container's filesystem?

Which kubectl command can be used to exec into a running container for forensic analysis during an incident response?

A security team wants to detect any attempt to open /etc/shadow in a container. Which Falco rule condition field is MOST appropriate?

A security policy requires that all pods in a namespace must run with a read-only root filesystem. Which admission controller can enforce this?

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

During a security incident, you need to snapshot the processes running inside a container without using kubectl exec. Which crictl command sequence can you use?

Which crictl command is used to view the logs of a specific container in a node?

An audit policy is configured with level: Request. Which operations are recorded in the audit log?

Which crictl command can you use to view the logs of a specific container?

A developer wants to ensure that a pod can only receive traffic from pods with label 'app: frontend' in the same namespace. Which NetworkPolicy egress rule should be applied to the source pods?

Which THREE of the following are recommended incident response steps when a container is compromised?

You need to configure the Kubernetes API server to log all requests at the Metadata level. Which flag should you use when starting kube-apiserver?

During a security incident, you need to isolate a compromised pod named 'malicious-pod' in namespace 'default' to prevent it from communicating with other pods. Which command should you run?

A security admin needs to audit all API requests to the Kubernetes API server. Which audit policy level logs the request body and response body?

Which TWO of the following are valid Falco output fields?

A Falco rule is configured to detect privilege escalation via setuid binaries. Which syscall is commonly associated with this activity?

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

Which Kubernetes resource can be used to enforce that a container's filesystem is read-only?

You are investigating a security incident where a container ran a shell inside a pod. Which Falco rule condition would trigger on a shell spawned in a container?