Containers and Orchestration GCTD Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   During an incident response, a security team discovers that a container mounted a hostPath volume and modified a critical system file. The team needs to determine the extent of the modification and preserve evidence. The container has already been stopped. Which action provides the most useful forensic evidence?

   • ACreate a forensic image of the hostPath volume and compare it with a known-good backup.
   • BReview the container's stdout logs for any commands that were executed.
   • CRestart the container to see if the modification persists.
   • DCheck the Kubernetes audit logs for the pod creation event.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which event in a container registry should be treated as a potential security concern?

   • AA pull request from a new or unexpected user account
   • BA read-only API call to list repository names
   • CA push of a new image tag by a CI/CD pipeline
   • DA scheduled vulnerability scan completing successfully
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating a container that is making repeated outbound connections to a known command-and-control IP. The analyst needs to identify which process inside the container initiated the connections and what system calls it used. The container is running on a host with limited auditing enabled. Which approach provides the most direct evidence for this investigation?

   • AUse `kubectl exec` to run `ss -tnp` inside the container to list active connections and their owning process.
   • BEnable Kubernetes audit logging and review the API server logs for the pod's network activity.
   • CReview the container image's Dockerfile to determine which processes are configured to run at startup.
   • DDeploy a runtime security agent that uses eBPF to trace process execution, syscalls, and network connections from the container.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which monitoring implication is most directly associated with the ephemeral nature of containers?

   • AContainer monitoring only needs to focus on the host operating system.
   • BMonitoring must be configured to automatically discover and track containers as they are created and destroyed.
   • CContainer logs are permanently stored on the host and do not require aggregation.
   • DContainer images must be monitored in real time for process execution.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which activity is most directly monitored by container runtime monitoring?

   • AImage vulnerability scanning
   • BSystem calls made by container processes
   • CRegistry authentication events
   • DKubernetes API server audit logs
   Reveal Solution Discussion Select an answer first