hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A container workload unexpectedly starts a shell,…
A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the evidence source phase, Which evidence source best supports or refutes the detection?
⚠ Common exam trap
CompTIA often tests the distinction between passive, periodic compliance artifacts (vulnerability scans, password reports) and active, real-time telemetry (runtime events, audit logs, network flows) that directly capture the sequence of malicious actions in a containerized environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Container runtime events, Kubernetes audit logs, and network flow from the pod
Container runtime events (e.g., from containerd or CRI-O) capture process spawns like an unexpected shell, Kubernetes audit logs record API calls that could indicate a compromised pod mounting the host filesystem, and network flow logs from the pod (e.g., via eBPF or Calico) reveal outbound connections to an unknown IP. Together, these three telemetry sources provide direct, real-time evidence of the three suspicious behaviors described, making them the most useful for detection and investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only monthly vulnerability scan summaries
Why it's wrong here
Monthly vulnerability scan summaries provide a static snapshot of known weaknesses in container images or host configurations at a specific point in time. However, they do not offer real-time visibility into dynamic runtime events, such as an unexpected shell execution within a container or unauthorized host filesystem mounts. These scans identify potential vulnerabilities but cannot detect active exploitation or post-exploitation activities as they occur, making them inadequate for identifying the immediate indicators of compromise described.
- ✗
Only user password age reports
Why it's wrong here
User password age reports are crucial for identity and access management hygiene, indicating potential stale credentials or compliance with password policies. However, they are entirely unrelated to the operational security of container workloads, Kubernetes orchestration, or the detection of container escape attempts. A container unexpectedly starting a shell and mounting the host is a process-level and filesystem-level event, not an authentication or credential management issue, thus these reports offer no telemetry for detecting these specific runtime anomalies.
- ✗
Only physical datacenter access logs
Why it's wrong here
Physical datacenter access logs record entries and exits to the physical infrastructure, providing security insights into the perimeter of the facility. While important for overall physical security, these logs have no direct correlation or visibility into logical activities occurring within virtualized environments, such as container pods or their underlying host operating systems. They cannot detect a container initiating a shell or mounting the host filesystem, as these are software-defined events occurring at the application and operating system layers, far removed from physical access controls.
- ✓
Container runtime events, Kubernetes audit logs, and network flow from the pod
Why this is correct
Container runtime events, such as those from an agent like Falco or eBPF, directly monitor process execution, file system access, and system calls within the container, immediately flagging an unexpected shell or host mount. Kubernetes audit logs capture API server requests, revealing if the container's configuration was modified or if a privileged pod was created, indicating orchestration-level compromise. Network flow from the pod provides crucial visibility into any attempted exfiltration or command-and-control communication initiated by the compromised container, completing the forensic picture. Together, these telemetry sources offer comprehensive detection and context for container escape attempts.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Telemetry
Telemetry is the automatic collection, transmission, and measurement of data from remote sources to a central system for analysis and monitoring.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.