A DevOps team deploys a new microservice to Kubernetes. Within hours, the service's pod CPU usage spikes to 95% and the application becomes unresponsive. The team suspects a crypto-mining container may have been injected. Which monitoring signal would most quickly confirm this suspicion?

Kubernetes events showing repeated pod restarts due to liveness probe failures.

Network flow logs showing the pod communicating with an external IP on port 443.

Container image vulnerability scan report showing a high-severity CVE in the base image.

Container runtime process list showing an unknown binary named 'xmrig' running inside the pod.

A containerized application is suspected of being compromised. The security team needs to preserve forensic evidence while minimizing disruption to the running container. Which action should be taken first?

Rebuild the container from a clean image and redeploy.

Immediately kill the container to prevent further damage.

Capture a memory dump of the container process and snapshot the container's file system.

Delete the container image from the registry to prevent reuse.

A company policy requires that all container images run as a non-root user and that no privileged containers are deployed. The security team needs to continuously enforce this policy across a Kubernetes cluster. Which mechanism should they implement?

Run periodic `kubectl get pods -o yaml` and manually review

Scan container images for root user in Dockerfile

Use an admission controller like OPA/Gatekeeper to validate pod security contexts

Monitor container runtime logs for root user activity

A SOC team wants to aggregate logs from container runtimes, Kubernetes control plane, and applications into a single platform for threat hunting. The platform must support complex queries and long-term retention. Which deployment approach is most appropriate?

Use a commercial SIEM that only supports predefined queries.

Deploy a self-managed Elasticsearch cluster with Logstash or Fluentd for ingestion and Kibana for visualization.

Send all logs to a simple syslog server and store them in flat files.

Use a cloud provider's object storage to store raw logs without indexing.

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 3)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 11–15

11application · medium
A DevOps team deploys a new microservice to Kubernetes. Within hours, the service's pod CPU usage spikes to 95% and the application becomes unresponsive. The team suspects a crypto-mining container may have been injected. Which monitoring signal would most quickly confirm this suspicion?
Select an answer first
12application · medium
A containerized application is suspected of being compromised. The security team needs to preserve forensic evidence while minimizing disruption to the running container. Which action should be taken first?
Select an answer first
13application · medium
A company policy requires that all container images run as a non-root user and that no privileged containers are deployed. The security team needs to continuously enforce this policy across a Kubernetes cluster. Which mechanism should they implement?
Select an answer first
14application · medium
A SOC team wants to aggregate logs from container runtimes, Kubernetes control plane, and applications into a single platform for threat hunting. The platform must support complex queries and long-term retention. Which deployment approach is most appropriate?
Select an answer first
15foundation · easy
Which threat detection technique involves establishing a baseline of normal container behavior and flagging deviations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.