An attacker compromises a Kubernetes cluster and creates a Deployment that runs a cryptocurrency miner. The deployment is configured with a single replica. The incident responder wants to prevent the deployment from scaling up and to capture the deployment's configuration for evidence. Which sequence of actions should the responder take?

Delete the deployment and then export the pod logs

Export the deployment YAML first, then scale to zero

Patch the deployment to set replicas to 0 and then delete the deployment

Scale the deployment to zero and then export the deployment YAML

During a forensic investigation, you discover that an attacker used a Kubernetes ServiceAccount token to authenticate to the API server and then created a CronJob that runs every minute to exfiltrate data. The token was found in a public container image in the company's registry. Which combination of controls would have most effectively prevented this attack?

Enable audit logging and monitor for CronJob creation

Use RBAC to restrict the service account's permissions and rotate the token regularly

Disable automatic mounting of service account tokens and enforce image scanning for secrets

Use a private container registry with access controls

A responder is analyzing kubelet logs and sees repeated requests to the kubelet's /run/secrets/kubernetes.io/serviceaccount/token endpoint from a pod that is not scheduled on that node. What does this indicate?

The pod is legitimately accessing the kubelet to retrieve its own service account token

The pod is performing a health check on the kubelet

The kubelet is misconfigured to allow cross-node token access

The pod is using a service account token from another node, indicating a possible token theft or misconfiguration

During incident response, you find that an attacker gained access to the Kubernetes API server using a kubelet client certificate that was valid for a single worker node. The attacker then used that certificate to retrieve secrets from pods running on that node. Which control would have most directly prevented this lateral movement?

Configuring the kubelet to use read-only port 10255 and disabling the authenticated port

Enabling NodeRestriction admission controller to limit kubelet API access to node-related resources

Using the Node authorizer and NodeRestriction to ensure kubelet credentials can only access resources associated with that specific node

Rotating the certificate authority used to sign kubelet certificates

GIAC Cloud Forensics Responder

Domain 6Objective 1

Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 3)

Part of the Kubernetes Forensics domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~4–7 in this domain), expect 4–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 11–15

11application · medium
An attacker compromises a Kubernetes cluster and creates a Deployment that runs a cryptocurrency miner. The deployment is configured with a single replica. The incident responder wants to prevent the deployment from scaling up and to capture the deployment's configuration for evidence. Which sequence of actions should the responder take?
Select an answer first
12expert · hard
During a forensic investigation, you discover that an attacker used a Kubernetes ServiceAccount token to authenticate to the API server and then created a CronJob that runs every minute to exfiltrate data. The token was found in a public container image in the company's registry. Which combination of controls would have most effectively prevented this attack?
Select an answer first
13application · medium
A responder is analyzing kubelet logs and sees repeated requests to the kubelet's /run/secrets/kubernetes.io/serviceaccount/token endpoint from a pod that is not scheduled on that node. What does this indicate?
Select an answer first
14expert · hard
During incident response, you find that an attacker gained access to the Kubernetes API server using a kubelet client certificate that was valid for a single worker node. The attacker then used that certificate to retrieve secrets from pods running on that node. Which control would have most directly prevented this lateral movement?
Select an answer first
15foundation · easy
Which logging pattern in Kubernetes involves a dedicated container within the same Pod that collects and forwards logs from the application container?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 3)

Questions 11–15

A responder is analyzing kubelet logs and sees repeated requests to the kubelet's /run/secrets/kubernetes.io/serviceaccount/token endpoint from a pod that is not scheduled on that node. What does this indicate?

Which logging pattern in Kubernetes involves a dedicated container within the same Pod that collects and forwards logs from the application container?

Keep studying — Kubernetes Forensics