CKS Practice Question: Which TWO actions are effective for detecting and…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Set 'securityContext.seccompProfile.type: Unconfined' to allow all syscalls.

  Why it's wrong here

  Setting seccompProfile.type to Unconfined explicitly disables the seccomp filter for the container, meaning every syscall is allowed without any kernel-level vetting. This removes a critical defense-in-depth layer, leaving the container exposed to syscalls that are commonly abused for breakout attempts such as `unshare`, `mount`, or `ptrace`. Far from helping detect or prevent attacks, Unconfined widens the attack surface and makes container escapes easier. Kubernetes best practice is to keep the default `RuntimeDefault` profile or a custom restrictive profile, never Unconfined unless there is a very specific and justified need.

• ✗

  Enable Kubernetes audit logging to capture exec commands.

  Why it's wrong here

  Kubernetes audit logging records API server requests, such as `kubectl exec` commands, but it is fundamentally passive and cannot stop an attack in progress. Exec activity is merely logged for after-the-fact forensic analysis, not inspected in real time nor blocked at the syscall or process level. A container escape often involves kernel vulnerabilities or misconfigurations that generate no API events at all, so relying on audit logs would miss the actual breakout signal. Therefore, while audit logs are useful for compliance and post-incident investigation, they are not an effective detection or prevention mechanism for runtime breakout attempts.

• ✗

  Use PodSecurityPolicy to deny privileged containers.

  Why it's wrong here

  PodSecurityPolicy (PSP) has been deprecated since Kubernetes v1.21 and was completely removed in v1.25, so it cannot be used in current clusters. Even where PSP is still available, it acts as an admission controller that only validates pod specifications at creation time, providing no runtime monitoring or enforcement inside the container. Denying privileged containers is a useful baseline hardening step, but many real-world container escapes exploit kernel vulnerabilities or leverage other capabilities (e.g., CAP_SYS_ADMIN) that do not require the `privileged` flag. Consequently, PSP neither detects active breakouts nor blocks the majority of modern escape vectors, making it an obsolete and insufficient answer.

• ✓

  Deploy Falco with rules that alert on 'syscall' events like 'clone' or 'unshare'.

  Why this is correct

  Falco is a runtime security tool that monitors system calls using kernel instrumentation (e.g., eBPF) and can emit real-time alerts when suspicious syscalls occur. Rules that alert on `clone`, `unshare`, `setns`, or similar syscalls are specifically designed to detect container breakout attempts, such as a process creating a new namespace to gain host-level visibility, or attaching to a host process. This detection is proactive: it catches the early stages of an attack and enables immediate response, rather than passively logging events. Falco's syscall-based alerting directly addresses the container-container and container-host boundaries, making it an effective detection mechanism for potential compromises.

• ✓

  Apply a seccomp profile that blocks unneeded syscalls for each container.

  Why this is correct

  Applying a seccomp profile that disallows unneeded syscalls is a powerful preventive control because it reduces the kernel attack surface available to a container. By blocking dangerous syscalls such as `unshare`, `mount`, or `ptrace` unless explicitly required, the profile makes common container-escape techniques fail with an `EPERM` error before they can compromise the host kernel. This is a kernel-level enforcement that runs independently of application intent, so even a compromised process inside the container cannot invoke blocked syscalls. A well-crafted seccomp profile is highly effective at stopping breakouts, and it complements detection tools like Falco by stopping attacks preemptively.

Go deeper

Related to this question