MENU
SIMULATION
Using the runtime detection tool Falco, Analyse the container behavior for at least 20 seconds, using filters that detect newly spawning and executing processes in a single container of Nginx.
store the incident file art /opt/falco-incident.txt, containing the detected incidents. one per line, in the format
[timestamp],[uid],[processName]
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
ST
Stephaine
1 year ago
How does it handle false positives though?
NO
Norah
1 year ago
I’ve used it before, and it’s pretty reliable!
GO
Golda
1 year ago
Wait, does it really catch everything? I’ve heard mixed reviews.
NI
Nida
1 year ago
That’s awesome! Falco is super useful for monitoring.
CR
Craig
1 year ago
Just ran Falco for 20 seconds on Nginx, caught some new processes!
DE
Delsie
1 year ago
I definitely remember the incident file format, but I’m worried I might mix up the order of uid and processName.
HO
Hollis
1 year ago
I think we had a similar question in our last mock exam, where we had to analyze logs. I hope I can recall the right commands.
HY
Hyman
1 year ago
I remember practicing with Falco, but I’m not sure about the exact filter syntax for detecting processes.
BR
Brandee
1 year ago
I feel a bit uncertain about the timestamp format. Was it just the time or did we need to include the date too?
AL
Alison
1 year ago
Hmm, I'm a little unsure about this one. I know the different components of attitude, but I'm having trouble remembering which one is specifically about beliefs. I'll have to think this through carefully.
RO
Robt
1 year ago
Wait, what? LDAP roles in Okta? I'm not too familiar with that. Let me think this through carefully and see if I can figure out the right answer.