Question

A DevSecOps team runs a microservices application on a Kubernetes cluster. Security wants to detect and block anomalous runtime behavior inside running containers—such as a process spawning an unexpected shell or making unauthorized outbound connections—without modifying application code. Which capability best meets this requirement?

Accepted Answer

A container runtime (workload) security agent that monitors syscalls and enforces behavioral policies on running pods

Answer

A static application security testing (SAST) scan integrated into the CI build stage

Answer

Signing container images and enforcing admission control to reject unsigned images

Answer

A software composition analysis (SCA) tool that inventories third-party library vulnerabilities