A containerized workload that spawns a background shell process outside of its original image configuration is considered a _____ event.

Question

Options

• Akill-chain
• Bbenchmark
• Cvalidation
• Ddrift

• A
  3% (1)
• B
  5% (2)
• D
  92% (34)

Explanation

Drift describes any deviation from a container's known-good baseline state - when a running container spawns a shell process not defined in its original image, it has "drifted" from its expected configuration, which is a security red flag (often indicating a breach or misconfiguration).

• A (kill-chain) is wrong because kill-chain describes the stages of a cyberattack (recon → exploit → exfil), not a specific runtime anomaly.
• B (benchmark) is wrong because benchmarks are performance or compliance baselines used for measurement, not runtime behavior classification.
• C (validation) is wrong because validation refers to verifying that a system meets expected criteria - the opposite of detecting unexpected behavior.

Memory tip: Think of "drift" like a ship drifting off course - the container is no longer where (or what) it's supposed to be. Runtime security tools like Falco and Sysdig specifically use the term drift detection to flag processes spawned inside containers that weren't part of the original image.

No community discussion yet for this question.