ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your organization runs a containerized web application on a managed Kubernetes cluster. To strengthen continuous monitoring, you must configure security telemetry sent to the SIEM so that attempted runtime privilege-escalation inside any container is detected as soon as it happens. Which data source should you prioritize forwarding?
Application access logs produced by the web servers in each container
Scheduled configuration snapshots exported from the Kubernetes API server
Kernel-level system call events collected by a container runtime or eBPF sensor
Virtual network flow logs captured from the cluster's network interfaces
Privilege escalation inside a running container is best identified by monitoring the low-level operating-system events that occur when a process tries to change its user or group privileges (for example, setuid or setgid system calls). Kernel-level system call telemetry gathered by a container runtime or eBPF-based sensor (such as Falco) surfaces these events in near real time, allowing the SIEM to alert immediately. Web-server access logs focus on HTTP requests and rarely expose internal privilege changes. Network flow logs show traffic patterns but not internal process activities. Periodic Kubernetes API snapshots capture configuration changes, not moment-to-moment actions occurring inside containers. Therefore, kernel-level system call events provide the most timely and reliable indication of container privilege escalation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is eBPF and how does it help with monitoring in containers?
Open an interactive chat with Bash
Why aren't application access logs sufficient for detecting privilege escalation?
Open an interactive chat with Bash
What is a SIEM, and how does it use kernel-level system call telemetry?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)