A forensic investigator is examining a compromised Kubernetes cluster and finds that an attacker used a service account token from a pod to call the Kubernetes API and create a new pod in the kube-system namespace. The service account was bound to a Role that only allowed 'get' and 'list' on pods in the default namespace. What is the most likely reason the attacker succeeded?

The attacker exploited a vulnerability in the API server to bypass RBAC

The attacker used the service account token but the API server had RBAC disabled or the RoleBinding was misconfigured to allow create in kube-system

The Role was bound to the service account in the kube-system namespace, granting broader permissions than intended

The service account token was actually a cluster-admin token

GIAC Cloud Forensics Responder

Domain 6Objective 1

Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 2)

Part of the Kubernetes Forensics domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~4–7 in this domain), expect 4–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 6–10

6foundation · easy
Which Kubernetes object is the smallest deployable unit that can be created, scheduled, and managed, and typically runs one or more containers with shared storage and network?
Select an answer first
7foundation · easy
Which log collection method is best suited for an application that writes logs to a file inside its container, when you want to forward those logs without modifying the application code?
Select an answer first
8foundation · easy
An attacker gains access to a Kubernetes cluster by using a service account token that was accidentally committed to a public code repository. Which type of attack vector does this represent?
Select an answer first
9foundation · easy
Which Kubernetes object provides a stable network endpoint (IP address and DNS name) to access a set of Pods, even as individual Pods are created or destroyed?
Select an answer first
10expert · hard
A forensic investigator is examining a compromised Kubernetes cluster and finds that an attacker used a service account token from a pod to call the Kubernetes API and create a new pod in the kube-system namespace. The service account was bound to a Role that only allowed 'get' and 'list' on pods in the default namespace. What is the most likely reason the attacker succeeded?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 2)

Questions 6–10

Which Kubernetes object is the smallest deployable unit that can be created, scheduled, and managed, and typically runs one or more containers with shared storage and network?

Which log collection method is best suited for an application that writes logs to a file inside its container, when you want to forward those logs without modifying the application code?

An attacker gains access to a Kubernetes cluster by using a service account token that was accidentally committed to a public code repository. Which type of attack vector does this represent?

Which Kubernetes object provides a stable network endpoint (IP address and DNS name) to access a set of Pods, even as individual Pods are created or destroyed?

Keep studying — Kubernetes Forensics