During a red team exercise, a tester gains code execution inside a Windows container running on AKS. The container is running with process isolation and has a mount of the host's Docker socket. The tester wants to escape to the host. Which technique is most likely to succeed?

Use the container's service account token to create a privileged pod on the same node.

Use the Docker socket to create a new container with the host's root filesystem mounted and run commands from there.

Exploit a kernel vulnerability in Windows to break out of the container's isolation.

Modify the container's registry to change its isolation level to Hyper-V and then escape.

An AKS cluster runs Windows containers with a pod security policy that restricts privileged containers. The security team wants to prevent container escape via the Docker socket. However, a legacy application requires access to the host's Docker daemon for management. Which solution best balances security and the application's requirement?

Use a sidecar container that has the Docker socket mount and expose an API to the legacy application.

Refactor the application to use the Kubernetes API instead of the Docker daemon.

Mount the Docker socket into the container but run the container with a read-only filesystem and drop all capabilities.

Allow the Docker socket mount only in a separate namespace with strict network policies.

In an AKS cluster running Windows containers, you discover that the cluster's kubelet is configured with `--anonymous-auth=true` and the node's firewall allows access from the internet. An attacker has network access to the kubelet port. Which attack is the most immediate risk?

The attacker can modify the cluster's Kubernetes secrets.

The attacker can directly access the Windows host's file system through the kubelet.

The attacker can create new pods in the cluster.

The attacker can access the kubelet API and execute commands in containers without authentication.

Which defensive strategy is most effective in limiting the impact of a compromised Azure Function?

Disabling all triggers to prevent any invocation

Assigning the function a managed identity with only the minimum permissions required

Placing the function in a public subnet with no network restrictions

Using a storage account connection string in the function's application settings

GIAC Cloud Penetration Tester

Domain 3Objective 3

Azure Functions and Windows Containers GCPN Practice Questions (Page 3)

Part of the Cloud Platform Attacks domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

Questions 11–15

11expert · medium
During a red team exercise, a tester gains code execution inside a Windows container running on AKS. The container is running with process isolation and has a mount of the host's Docker socket. The tester wants to escape to the host. Which technique is most likely to succeed?
Select an answer first
12expert · medium
An AKS cluster runs Windows containers with a pod security policy that restricts privileged containers. The security team wants to prevent container escape via the Docker socket. However, a legacy application requires access to the host's Docker daemon for management. Which solution best balances security and the application's requirement?
Select an answer first
13foundation · easy
In a Windows container using process isolation, what is shared between the container and the host operating system?
Select an answer first
14expert · hard
In an AKS cluster running Windows containers, you discover that the cluster's kubelet is configured with `--anonymous-auth=true` and the node's firewall allows access from the internet. An attacker has network access to the kubelet port. Which attack is the most immediate risk?
Select an answer first
15foundation · easy
Which defensive strategy is most effective in limiting the impact of a compromised Azure Function?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Azure Functions and Windows Containers GCPN Practice Questions (Page 3)

Questions 11–15

During a red team exercise, a tester gains code execution inside a Windows container running on AKS. The container is running with process isolation and has a mount of the host's Docker socket. The tester wants to escape to the host. Which technique is most likely to succeed?

In a Windows container using process isolation, what is shared between the container and the host operating system?

In an AKS cluster running Windows containers, you discover that the cluster's kubelet is configured with `--anonymous-auth=true` and the node's firewall allows access from the internet. An attacker has network access to the kubelet port. Which attack is the most immediate risk?

Which defensive strategy is most effective in limiting the impact of a compromised Azure Function?

Keep studying — Cloud Platform Attacks