CKS Monitoring, Logging and Runtime Security Practice Question
Which kubectl command can be used to execute a shell inside a running container for forensic analysis?
⚠ Common exam trap
CKS often tests whether candidates confuse read-only inspection commands (`logs`, `describe`) with interactive execution — the trap is picking `logs` because it 'shows what's happening' when the question actually requires shell access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl exec -it <pod> -- /bin/sh
The `kubectl exec -it <pod> -- /bin/sh` command opens an interactive TTY (`-it`) into a running container and launches a shell (`/bin/sh`), which is exactly what's needed for live forensic analysis inside a compromised or suspect container. It does not restart or alter the pod, preserving volatile evidence like running processes, open file descriptors, and in-memory artifacts. This is the standard CKS-recommended approach for container-level incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl delete pod <pod>
Why it's wrong here
kubectl delete pod <pod> sends a termination request for the pod, causing its containers to be stopped and removed. This is a lifecycle management operation, completely unrelated to running commands inside the container; it does not provide any shell access and if executed would destroy the very container you intend to interact with.
- ✗
kubectl logs <pod>
Why it's wrong here
kubectl logs <pod> only streams the container's stdout/stderr history or logs; it is a read-only operation and does not open any interactive channel. Even with the -f flag, it only follows log output and cannot accept stdin, so you cannot execute a shell or send commands to the container.
- ✗
kubectl describe pod <pod>
Why it's wrong here
kubectl describe pod <pod> fetches and displays detailed metadata about the pod, including its current status, events, labels, annotations, and container resource requests/limits. It is purely informational and read-only; it never contacts the container runtime to start a process, so no command execution or shell is possible.
- ✓
kubectl exec -it <pod> -- /bin/sh
Why this is correct
kubectl exec -it <pod> -- /bin/sh is correct because -i keeps stdin open for the session, -t allocates a pseudo-TTY, and the -- separates the command to run inside the container. This combination starts an interactive shell as long as /bin/sh is present in the container's filesystem; if it is not, a similar command with /bin/bash or an ephemeral debug container would be needed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.