An administrator sees that a runtime audit has been generated for a container. The audit message is: "/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr" Which…

The correct answer is C. Processes. The audit message specifically identifies a process - '/bin/ls' - being launched inside a container and blocked by the runtime rule. In Prisma Cloud Compute's runtime rule framework, the 'Processes' protection component governs which executables and processes are allowed or…

Container Security

Question

An administrator sees that a runtime audit has been generated for a container. The audit message is:

"/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr" Which protection in the runtime rule would cause this audit?

Options

ANetworking
BFile systems
CProcesses
DContainer

How the community answered

(40 responses)

A
5% (2)
B
3% (1)
C
90% (36)
D
3% (1)

Explanation

The audit message specifically identifies a process - '/bin/ls' - being launched inside a container and blocked by the runtime rule. In Prisma Cloud Compute's runtime rule framework, the 'Processes' protection component governs which executables and processes are allowed or denied from running inside a container. When a process like 'ls' is added to the explicitly blocked list under the Processes section of a runtime rule, any attempt to run it generates this exact type of audit message. 'Networking' (A) covers network connections and DNS lookups. 'File systems' (B) covers file and directory access. 'Container' (D) is not a specific sub-protection type within runtime rules.

Topics

#Container runtime protection#Process blocking#PCCSE#Cloud native security

Community Discussion

No community discussion yet for this question.

Full PCCSE Practice