CKS kubectl exec Practice Question
During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?
⚠ Common exam trap
The exam may test that `kubectl exec` is the kubectl command used to run commands inside a container, enabling process inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl exec <pod-name> -- ps aux
`kubectl exec <pod-name> -- ps aux` runs the `ps aux` command inside the container, which lists running processes. It is the only kubectl command that allows you to inspect container processes. Options A, C, and D do not provide process listings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl logs <pod-name>
Why it's wrong here
The `kubectl logs` command reads the container's stdout/stderr streams recorded by the CRI runtime; it replays what a process emitted, not what processes are alive. A reverse shell might write nothing at all, or its only output could be an interactive prompt, so the log stream gives no reliable indication of process existence, PID, or command line. Logs are also a historical buffer, not a live snapshot of the process table, so they cannot be used to examine currently running processes.
- ✓
kubectl exec <pod-name> -- ps aux
Why this is correct
Correct. `kubectl exec <pod-name> -- ps aux` executes the `ps aux` command inside the container, displaying all active processes. This is the appropriate kubectl command to check for a reverse shell without requiring node-level access.
- ✗
kubectl top pod <pod-name>
Why it's wrong here
`kubectl top pod` queries the metrics pipeline (typically the metrics-server) to return CPU and memory usage aggregated per pod or per container, not a list of processes. Even if a reverse shell consumes CPU or memory, this command only shows utilization numbers, without process names, PIDs, or command arguments, so it cannot confirm a reverse shell's presence. Additionally, if metrics-server isn't installed or the pod isn't being sampled, the command fails or returns no data, but a process check via exec always reflects the live state.
- ✗
kubectl describe pod <pod-name>
Why it's wrong here
`kubectl describe pod` retrieves the pod object from the Kubernetes API, displaying metadata, container images, restart history, and recent events like liveness probe failures or OOMKills. It does not run any commands in the container and has no access to the container's /proc or PID namespace, so it cannot enumerate active processes. A reverse shell is typically a single process inside the container; unless it triggers a restart or probe failure, it won't appear in events or status, making describe effectively blind to its existence.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.