CCCS-203B · Question #186
A security analyst is reviewing a CrowdStrike Falcon Cloud Security detection report. The report flags a container running in a Kubernetes cluster as exhibiting suspicious behavior. The following…
The correct answer is C. The container is likely compromised, and an attacker may be attempting lateral movement. Option A: Networking misconfigurations can cause access issues but do not explain suspicious behaviors like unauthorized user creation or execution from unusual locations. Option B: While automated updates can sometimes trigger alerts, failed SSH attempts and execution from…
Question
A security analyst is reviewing a CrowdStrike Falcon Cloud Security detection report. The report flags a container running in a Kubernetes cluster as exhibiting suspicious behavior. The following behaviors were detected:
?Execution of curl commands to an external unknown IP ?Multiple failed SSH connection attempts from within the container ?A new user account was created within the container ?A process spawned from /dev/shm Based on these findings, what is the most likely conclusion, and what should the security team do next?
Options
- AThe container is experiencing a misconfiguration issue with outbound networking. Restart the pod
- BThe detection is a false positive caused by an automated update process. Mark the findings as
- CThe container is likely compromised, and an attacker may be attempting lateral movement.
- DThe issue is likely due to the use of a non-root container user. Modify the container to run as root
How the community answered
(23 responses)- A17% (4)
- B4% (1)
- C65% (15)
- D13% (3)
Explanation
Option A: Networking misconfigurations can cause access issues but do not explain suspicious behaviors like unauthorized user creation or execution from unusual locations. Option B: While automated updates can sometimes trigger alerts, failed SSH attempts and execution from /dev/shm are strong red flags. Marking this as benign without deeper investigation Option C: The observed behaviors (curl to unknown IP, failed SSH attempts, user creation, execution from shared memory /dev/shm) are strong indicators of compromise. This suggests an attacker may have gained initial access and is trying to expand their foothold. Immediate isolation and forensic analysis are critical steps. Option D: Running as root increases attack surface and is a bad security practice. The issue is not caused by a non-root user but by suspicious behavior within the container.
Topics
Community Discussion
No community discussion yet for this question.