Which network monitoring activity is most useful for detecting lateral movement between containers?

Monitoring north-south traffic for high volume

Monitoring east-west traffic for unexpected connections

Monitoring image pulls from the registry

Monitoring DNS queries for external domains

A company's container registry recently experienced a credential leak. The security team wants to detect unauthorized image pulls and ensure that only approved images are deployed. Which combination of controls best addresses this requirement?

Restrict network access to the registry using a firewall allowlist.

Scan images for vulnerabilities on push and block critical findings.

Enable registry audit logging and enforce image signing with a policy that rejects unsigned images.

Use a private registry with strong authentication and rotate credentials monthly.

During an incident response, a security team needs to collect forensic evidence from a compromised container that is still running. The team must preserve the container's state for analysis while also preventing further malicious activity. Which action best balances evidence preservation and containment?

Snapshot the container's file system only and then restart the container.

Kill the container immediately and rely on logs for evidence.

Pause the container using the runtime's pause feature, then capture a memory dump and file system snapshot.

Disconnect the container from the network using a network policy, then continue monitoring.

During incident response, a security analyst needs to collect forensic evidence from a compromised container. The container is still running, and the team wants to preserve volatile data while minimizing disruption to the production service. Which step should be taken first?

Snapshot the container's filesystem using `docker commit`

Immediately kill the container to prevent further damage

Review Kubernetes audit logs only

Capture the container's memory and process list using `docker inspect` and `docker exec`

A security analyst is monitoring a container that suddenly starts making DNS queries to a domain known for command-and-control (C2) activity. The analyst wants to confirm whether the container is compromised. Which monitoring data would provide the strongest evidence?

Container runtime syscall logs showing the process that initiated the DNS query and its parent process.

Node-level network flow logs showing the destination IP.

Kubernetes audit logs showing the pod's creation time.

Container image vulnerability scan results.

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 1)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 1–5

1foundation · easy
Which network monitoring activity is most useful for detecting lateral movement between containers?
Select an answer first
2application · medium
A company's container registry recently experienced a credential leak. The security team wants to detect unauthorized image pulls and ensure that only approved images are deployed. Which combination of controls best addresses this requirement?
Select an answer first
3expert · hard
During an incident response, a security team needs to collect forensic evidence from a compromised container that is still running. The team must preserve the container's state for analysis while also preventing further malicious activity. Which action best balances evidence preservation and containment?
Select an answer first
4expert · hard
During incident response, a security analyst needs to collect forensic evidence from a compromised container. The container is still running, and the team wants to preserve volatile data while minimizing disruption to the production service. Which step should be taken first?
Select an answer first
5application · medium
A security analyst is monitoring a container that suddenly starts making DNS queries to a domain known for command-and-control (C2) activity. The analyst wants to confirm whether the container is compromised. Which monitoring data would provide the strongest evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.