You must complete this task on the following cluster/nodes: Cluster | Master node | Worker node KSRS001 | ksrs00101-master | ksrs00101-worker1 You can switch the cluster/configuration context using…

Question

Explanation

This question tests your ability to use a runtime security tool (sysdig or falco) to monitor container process activity on a Kubernetes worker node and record detected incidents in a structured format. It covers the CKS domain of runtime behavioral analysis and threat detection.

Approach. The recommended approach is to SSH into the worker node (ksrs00101-worker1) and use sysdig with a process-spawn filter, or falco with a custom rule targeting execve syscalls, running for at least 30 seconds. With sysdig, the command would be: sysdig -M 30 -p '%evt.time,%user.uid,%proc.name' evt.type=execve > /opt/KSRS00101/alerts/details. This captures the timestamp in original sysdig format, the UID or username, and the process name for every new process execution - each on its own line. Alternatively, a custom Falco rule using evt.type=execve with output fields %evt.time,%user.uid,%proc.name achieves the same result. The output file must be placed on the worker node (not the master or CLI host), so you must either redirect output directly on the worker node via SSH, or copy the file there afterward.

Concept tested. Kubernetes runtime security monitoring - specifically using sysdig or Falco to perform syscall-level introspection on container workloads, filtering for process-spawn events (execve), and capturing structured incident data (timestamp, UID/username, process name) for forensic or audit purposes. This maps to the CKS exam domain: 'Runtime Security' and 'Behavioral Analytics / Threat Detection'.

Reference. https://falco.org/docs/rules/ - Falco Rules documentation; sysdig filter reference: https://github.com/draios/sysdig/wiki/sysdig-user-guide#filtering

No community discussion yet for this question.