MENU
You must complete this task on the following cluster/nodes: Cluster:trace Master node:master Worker node:worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $kubectl config use-context trace Given: You may use Sysdig or Falco documentation. Task: Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Podtomcat. Two tools are available to use: 1. falco 2. sysdig Tools are pre-installed on the worker1 node only. Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes. Store an incident file at/home/cert_masters/report, in the following format: [timestamp],[uid],[processName] Note:Make sure to store incident file on the cluster's worker node, don't move it to master node.
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
33 comments · newest first
SO
Son
11 months ago
Are you sure the tools are pre-installed on worker1? Sounds sketchy!
AU
Audry
11 months ago
Totally agree, falco rules are super helpful for container security.
GO
Goldie
12 months ago
Wait, you have to store the report on the worker node? That's odd!
SE
Selene
12 months ago
I prefer sysdig for this kind of analysis, way more user-friendly.
JO
Johnna
1 year ago
Just a heads up, falco is great for detecting anomalies!
KR
Kristin
1 year ago
I think I saw something in the Sysdig documentation about filtering processes too. Should we use Sysdig instead of Falco, or is it better to stick with Falco for this task?
EL
Elke
1 year ago
I feel a bit confused about where to store the incident file. Is it really just on the worker node and not on the master node? I hope I remember that correctly.
AN
Angella
1 year ago
I think we had a similar question about process monitoring in containers. If I recall correctly, we need to set the right filters in Falco to catch those newly spawned processes.
ED
Edna
1 year ago
I remember we practiced using Falco to detect anomalies, but I'm not entirely sure about the exact command to analyze the container's behavior for 40 seconds.
AR
Arlette
1 year ago
I'm a bit confused about this one. I know we're supposed to use Falco or Sysdig, but I'm not sure how to set up the monitoring and filters to detect the specific anomalies they're looking for. I'll need to review the documentation carefully and make sure I have the right approach.
DO
Doug
1 year ago
Okay, let's see. I need to use Falco to monitor the container and look for any suspicious process activity. I'll need to set up the rules to capture the timestamp, user ID, and process name, and save that to the report file. Sounds straightforward, but I'll need to be careful with the syntax and filters.
MA
Mariann
1 year ago
Hmm, this seems a bit tricky. I'll need to review the Falco and Sysdig documentation to understand how to set up the monitoring and filters properly. Hopefully, I can get the right configuration to detect the anomalies in the container.
WY
Wynell
1 year ago
I think I can handle this question. The key is to use the Falco detection tool to monitor the container's behavior and look for any anomalies like new processes spawning or executing something unusual. I'll need to configure the Falco rules to capture that information and save it to the report file.
CA
Cassi
1 year ago
Haha, I wonder if the exam writers have a sense of humor. 'Newly spawning and executing processes' - it sounds like we're dealing with some kind of container breakout or malware scenario. Better bring my popcorn!
ED
Edna
1 year ago
Let's get started and see what anomalies we can detect in the container.
PR
Princess
1 year ago
I hope it's not too serious, but it's definitely going to be a fun task.
LA
Lamonica
1 year ago
I'm excited to use the detection tools and see what we can find.
AR
Arthur
1 year ago
I know, right? Sounds like we're in for an interesting challenge.
DA
Daniel
1 year ago
I'm a bit confused about the output format for the incident file. The task mentions a specific format, but the solution doesn't seem to address that. I'll need to double-check the requirements.
OL
Oliva
1 year ago
Hmm, the task mentions using either Falco or Sysdig, but the solution is focused on Falco. I wonder if Sysdig would be a viable alternative, or if Falco is the preferred tool for this scenario.
FA
Fairy
1 year ago
I think using Falco would be the best choice for this specific scenario.
ME
Meghan
1 year ago
Sysdig might work as well, but Falco is more focused on container security.
TO
Tomas
1 year ago
Falco is the recommended tool for this task.
AN
Annamae
2 years ago
Looks like we need to use Falco to detect any anomalies in the Tomcat container. The rules provided look good, but I'll need to check the Falco documentation to make sure I'm understanding everything correctly.
TA
Tammara
1 year ago
Falco's rules for detecting container drift seem thorough. I'll review the documentation to ensure we set it up correctly for monitoring the Tomcat container.
FL
Floyd
1 year ago
I think using Falco will give us the most accurate results. Let's make sure we follow the rules correctly to detect any anomalies in the container.
AL
Alex
1 year ago
User 3: Let's refer to the Falco documentation to ensure we set up the rules correctly for detecting anomalies.
DE
Denise
1 year ago
User 2: Yes, the rules for detecting new executables in a container using Falco seem detailed.
DA
Darnell
1 year ago
I agree, Falco seems like the best tool to use for this task. The rules provided are detailed, but it's always good to double-check with the documentation.
SH
Sherron
1 year ago
User 1: I think we should use Falco to detect anomalies in the Tomcat container.
YO
Yolande
2 years ago
That's a good point, sysdig might give us better insights into the container's behavior.
RO
Rochell
2 years ago
I prefer using sysdig because it provides more detailed information.
YO
Yolande
2 years ago
I think I will use falco for this task.