Runtime Threat Detection
An attacker exploits a web app and spawns /bin/sh from inside the running process; no one runs kubectl exec. Which control is designed to detect this as it happens?
/bin/sh
kubectl exec
Choose one answer
A runtime security tool such as Falco watching syscalls, with a rule like "shell spawned in a container"
A default-deny NetworkPolicy in the namespace
Scanning the image with Trivy in the CI pipeline
The API server audit log at RequestResponse level
RequestResponse