ITGSS Certified DevOps Engineer Practice Test

Which types of activities are most relevant to monitor for Kubernetes security?

1. File and memory

2. Process and network

3. API and DNS

4. User and session

The correct answer is: Process and network

Focusing on process and network activities is crucial for monitoring Kubernetes security due to the unique architecture and operational dynamics of containerized applications. Kubernetes orchestrates containers that communicate over networks, and understanding both process execution and network interactions can reveal potential security issues such as unauthorized access, identity spoofing, and communication breaches. Monitoring processes allows for the detection of abnormal behaviors or execution of unauthorized containers or commands, which could indicate a security incident. For example, if a process is trying to spawn an unknown container or if there is a sudden increase in resource usage by certain processes, it could signal a compromise. On the network side, monitoring activities involves looking at the traffic between pods and services, which is essential as attackers often try to exploit vulnerabilities through network interactions. Observing suspicious traffic patterns can help identify attacks such as Distributed Denial of Service (DDoS) or lateral movement within the cluster. While file and memory activities, API and DNS interactions, and user and session activities are indeed important in their respective contexts, they don't directly capture the dynamic and transient nature of Kubernetes operations as effectively as process and network monitoring. Understanding the interplay between processes and network communications is key to maintaining a robust security posture in a Kubernetes environment.