A responder is reviewing Kubernetes audit logs and sees a series of 'delete' events for ConfigMaps in the default namespace. The events are attributed to a service account that is used by a legitimate application. The application does not normally delete ConfigMaps. What should the responder do first?

Assume the service account is compromised and revoke its credentials

Check whether the application was recently updated or misconfigured to delete ConfigMaps

Ignore the events because the service account is legitimate

Immediately delete the service account

A Kubernetes administrator is troubleshooting a pod that is not producing logs in the central logging system. The administrator checks the pod's logs using 'kubectl logs' and sees no output. The pod is running but the application is not writing to stdout. Which of the following is the most likely cause?

The node-level logging agent is not running on the node.

The application is writing logs to a file inside the container instead of stdout.

The pod is using a sidecar logging container that is not configured correctly.

The API server audit log is not enabled.

A responder is analyzing audit logs and sees a series of 'create' events for Pods in the default namespace, all using the image 'gcr.io/google-containers/pause'. The creating user is 'system:anonymous'. What does this indicate?

The pause container is being used for legitimate pod sandboxing

The kubelet is creating pause containers for new pods

The cluster is under a denial-of-service attack

Anonymous access is enabled and the user has permission to create pods

A security team is investigating a suspicious Deployment that was created in a Kubernetes cluster. The Deployment has a single replica and uses an image from a public registry. The team wants to determine whether the Deployment was created by a legitimate user or an attacker. Which evidence would be most useful?

The Deployment's YAML file showing the image name

The node's kubelet logs showing the pod scheduling

The Kubernetes audit log showing the user who created the Deployment

The pod's logs showing the application behavior

GIAC Cloud Forensics Responder

Domain 6Objective 1

Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 6)

Part of the Kubernetes Forensics domain, which makes up ~6% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~4–7 in this domain), expect 4–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 26–30

26application · medium
A responder is reviewing Kubernetes audit logs and sees a series of 'delete' events for ConfigMaps in the default namespace. The events are attributed to a service account that is used by a legitimate application. The application does not normally delete ConfigMaps. What should the responder do first?
Select an answer first
27application · medium
A Kubernetes administrator is troubleshooting a pod that is not producing logs in the central logging system. The administrator checks the pod's logs using 'kubectl logs' and sees no output. The pod is running but the application is not writing to stdout. Which of the following is the most likely cause?
Select an answer first
28application · medium
A responder is analyzing audit logs and sees a series of 'create' events for Pods in the default namespace, all using the image 'gcr.io/google-containers/pause'. The creating user is 'system:anonymous'. What does this indicate?
Select an answer first
29application · medium
A security team is investigating a suspicious Deployment that was created in a Kubernetes cluster. The Deployment has a single replica and uses an image from a public registry. The team wants to determine whether the Deployment was created by a legitimate user or an attacker. Which evidence would be most useful?
Select an answer first
30foundation · easy
Which Kubernetes component runs on every worker node and is responsible for ensuring that containers described in Pod specs are running and healthy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFR” is a trademark of its owner, used for identification only.

Kubernetes Overview, Logs, and Common Attacks GCFR Practice Questions (Page 6)

Questions 26–30

A responder is analyzing audit logs and sees a series of 'create' events for Pods in the default namespace, all using the image 'gcr.io/google-containers/pause'. The creating user is 'system:anonymous'. What does this indicate?

Which Kubernetes component runs on every worker node and is responsible for ensuring that containers described in Pod specs are running and healthy?

Keep studying — Kubernetes Forensics