CCNA Cks Monitoring Runtime Questions

An admin runs 'kubectl get pods' and sees a pod in 'CrashLoopBackOff' state. The pod's containers have a restart policy of 'Always'. What is the most likely cause?

You suspect a container is running an unexpected process. Which crictl command can you use to list all running containers on the node?

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the 'RequestResponse' level, but only log requests from the 'kube-system' namespace. Which audit policy rule is correct?

Which TWO of the following are valid audit stages in Kubernetes audit logging?

You want to preserve evidence from a compromised pod. Which command should you use to copy the entire container filesystem to a safe location?

To isolate a compromised pod and prevent all incoming and outgoing traffic, which Kubernetes resource should you use?

A Falco rule has the following condition: spawned_process and container and proc.name = bash and proc.pname != sshd. What does this rule detect?

Which THREE of the following are valid techniques for isolating a compromised pod during incident response? (Choose three)

Which flag must be provided to the kube-apiserver to enable audit logging?

Which THREE of the following are common indicators of a container compromise that Falco can detect? (Select 3)

A pod is stuck in Pending state. You run 'kubectl describe pod' and see the event: '0/3 nodes are available: 3 Insufficient cpu'. What is the likely cause?

You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?

A security team wants to detect any attempt to spawn an interactive shell inside a container. Which Falco rule condition would be appropriate?

Which THREE of the following are effective methods to preserve evidence during a container security incident?

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Which audit stage is logged after the request is fully processed and the response is sent?

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

A pod is running in the 'default' namespace with a container that has an immutable root filesystem (readOnlyRootFilesystem: true). The application writes logs to /var/log/app.log. What will happen?

Which audit policy level logs all requests and responses, including the request body and response body?

A Falco rule triggers when a shell is spawned inside a container. Which condition correctly identifies bash or sh being executed as the first process (PID 1)?

Which TWO of the following are valid audit policy levels in Kubernetes? (Choose two.)

You need to configure Kubernetes audit logging to log all requests at the Metadata level except for requests to the 'kube-system' namespace, which should be logged at Request level. How should you structure the audit policy?

You run 'crictl ps' and see a container with state CONTAINER_RUNNING. What does this indicate?

Which THREE of the following are required components to enable audit logging in Kubernetes? (Select three.)

You have a pod that is in CrashLoopBackOff. You want to inspect the logs from the previous instance of the container. Which flag should you use with kubectl logs?

Which THREE stages can be configured for Kubernetes audit logging?

You are configuring Kubernetes audit logging. You want to log all requests to the `secrets` resource in the `kube-system` namespace at the `RequestResponse` level, while logging all other requests at the `Metadata` level. Which audit policy configuration achieves this?

You run 'crictl ps' and see no output, but the node has running pods. What is the most likely cause?

Which crictl command lists all running containers on a node?

Which kubectl command can you use to view the logs of a specific container in a multi-container pod?

A Falco rule is triggered when a shell is spawned inside a container. Which syscall is typically used to detect shell execution?

You want to isolate a compromised pod by blocking all network traffic to and from it. Which NetworkPolicy would you apply?

A pod runs with an immutable root filesystem (readOnlyRootFilesystem: true). The application attempts to write to /tmp. What is the expected behavior?

An admin runs 'crictl ps' on a node and sees multiple containers. Which command should they use to view the logs of a specific container?

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

An administrator needs to preserve evidence from a compromised container. Which approach is BEST for capturing the container's filesystem and memory for later analysis?

Which kubectl command can be used to execute a shell inside a running container for forensic analysis?

Which TWO crictl commands can be used to inspect a running container?

You need to preserve evidence (container logs) from a compromised pod before deleting it. Which command should you run first?

An administrator wants to enable Kubernetes audit logging with the following requirements: log all requests at the Metadata level, but log all responses at the Request level. Which audit policy configuration achieves this?

Which THREE of the following are valid audit stages in Kubernetes audit logging? (Select THREE.)

You want to detect any attempt to run a shell inside a container that is not running as root. Which Falco condition would you use?

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

You are writing a Falco rule to detect privilege escalation via setuid binaries. Which syscall should the rule monitor?

A container has been compromised. You need to isolate it by denying all network traffic. Which NetworkPolicy manifest achieves this?

Which TWO of the following are valid audit stages in Kubernetes audit logging?

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

What is the purpose of setting a container's filesystem to read-only in a Pod spec?

A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

You want to ensure that a container's root filesystem is immutable. Which field in the Pod spec should you set?

Which crictl command is used to list all running containers managed by the container runtime?

A security team wants to detect attempts to read /etc/shadow inside containers. Which Falco rule condition would trigger on a container reading that file?

Which crictl command is used to view the logs of a specific container?

You need to detect when a container attempts to mount the host's Docker socket. Which Falco macro or condition would you use?

You have deployed a DaemonSet to run a logging agent on every node. After an update, the new pods are stuck in 'Pending' state. You run 'kubectl describe pod ds-pod-xxxxx' and see '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the MOST likely cause?

A pod named 'busybox-pod' is compromised. You want to isolate it from all other pods using a NetworkPolicy. Which YAML snippet correctly denies all ingress and egress traffic to/from the pod?

A Falco rule has the condition: 'evt.type=open and fd.name contains /etc/shadow and container.id != host'. What is being detected?

Which TWO of the following are valid audit stages in Kubernetes? (Choose two.)

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Which TWO of the following are valid audit stages in Kubernetes?

Which flag is used when starting kube-apiserver to enable audit logging?

An administrator wants to monitor runtime security events in Kubernetes using Falco. Which component must be deployed as a DaemonSet to capture system calls from containers?

Which TWO of the following are valid methods to detect a container spawning a shell (e.g., /bin/bash) using Falco? (Select two.)

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

Which of the following is NOT a valid priority level in a Falco rule?

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

Which TWO of the following are valid steps to respond to a runtime security incident where a container is suspected to be compromised? (Select two.)

A Falco rule detects unexpected outbound connections. Which condition would identify a connection to an external IP not in the allowed list?

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

You need to ensure that all containers in a pod cannot write to their root filesystem except for a specific directory `/data`. You set `securityContext.readOnlyRootFilesystem: true` and mount an emptyDir volume at `/data`. However, the container still cannot write to `/data`. What is the most likely cause?

Which TWO are valid stages in a Kubernetes audit event? (Select 2)