Exam
CKS
Home › CKS practice tasks › Finding a Pod Reading from /dev/mem
CKS · Monitoring, Logging and Runtime Security
Finding a Pod Reading from /dev/mem
One of the Pods belonging to the application ollama is misbehaving. It is directly accessing the system's memory reading from the sensitive file /dev/mem.
🗓️ Free Task of the Week: one CKS task is unlocked free for everyone every week - no card, real cluster, auto-graded (2 tries/week). Create a free account and check whether this one is live now.
The task
Context
A Pod is misbehaving and poses a security threat to the system.
Task
One of the Pods belonging to the application ollama is misbehaving. It is directly accessing the system's memory reading from the sensitive file /dev/mem.
First, identify the misbehaving Pod accessing /dev/mem.
The cluster uses the Docker Engine as its container runtime. If needed, use the docker command to troubleshoot running containers.
Next, identify the Deployment managing the misbehaving Pod and scale it to zero replicas.
> Do not modify the Deployment except for scaling it down. Do not modify any other Deployments. Do not delete any Deployments.
*Lab note: this practice node runs containerd rather than the Docker Engine, so the docker CLI is not available here. Falco is preinstalled on this node as a DaemonSet (namespace falco) and loads rules from /etc/falco/rules.d/; writing a small detection rule is the fastest way to catch the offender (crictl works too). Only the containment is graded: the offending Deployment at 0 replicas with the other Deployments untouched.*
What this tests
Detect threats at runtime with Falco, behavioral analytics, and audit logging. On the CKS exam, Monitoring, Logging and Runtime Security tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.
Practice it for real
prepium.sh drops you into your own isolated Kubernetes cluster in the browser - no install, no credit card. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). The canonical solution unlocks after you attempt it, so you learn the fast, exam-ready way to do it.