How would you answer an interview scenario involving runtime detection and response in Container Security?

A web container unexpectedly launches a shell and connects to an unknown external address. Explain detection and response.