Which event in container storage monitoring could indicate data exfiltration?

A container mounting a volume at startup

A scheduled backup job accessing a volume

A volume being resized by an administrator

A sudden large read of a volume from a container that normally writes only

Which container configuration is often checked for compliance with security best practices?

Running containers as a non-root user

A Kubernetes cluster is experiencing a pod that consumes excessive CPU and memory, causing node instability. The security team suspects a resource abuse attack. The team needs to identify the responsible workload without disrupting other applications. Which monitoring approach is most effective?

Restart all pods in the cluster to stop the abuse.

Use Kubernetes metrics (e.g., Metrics Server) to identify the pod with the highest resource usage and correlate with runtime process data.

Disable the node's CPU scheduler to prevent further abuse.

Review Kubernetes audit logs for any changes to resource limits.

A company's compliance team requires that all container images be scanned for vulnerabilities before deployment and that the scan results be retained for audit. The team also wants to prevent deployment of images with critical vulnerabilities. Which control should be implemented?

Require developers to sign images after testing.

Integrate the container registry with a vulnerability scanner and configure an admission controller to block images with critical findings.

Use a runtime security tool to block vulnerable images at runtime.

Run a vulnerability scanner manually before each deployment and document the results in a spreadsheet.

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 11)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 51–55

51foundation · easy
Which event in container storage monitoring could indicate data exfiltration?
Select an answer first
52foundation · easy
Which type of log is most important for detecting unauthorized API access in a Kubernetes cluster?
Select an answer first
53foundation · easy
Which container configuration is often checked for compliance with security best practices?
Select an answer first
54expert · hard
A Kubernetes cluster is experiencing a pod that consumes excessive CPU and memory, causing node instability. The security team suspects a resource abuse attack. The team needs to identify the responsible workload without disrupting other applications. Which monitoring approach is most effective?
Select an answer first
55application · medium
A company's compliance team requires that all container images be scanned for vulnerabilities before deployment and that the scan results be retained for audit. The team also wants to prevent deployment of images with critical vulnerabilities. Which control should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.