A security engineer is investigating a suspicious Kubernetes API server request that created a new deployment with a hostPath volume. The request came from a service account used by a CI/CD pipeline. The engineer needs to determine whether the service account was compromised or the pipeline was misconfigured. Which evidence would be most decisive?

Check the service account's permissions to see if it can create deployments with hostPath volumes.

Correlate the API server audit log with the CI/CD pipeline's execution logs to see if the request matches a known pipeline run.

Review the deployment's pod logs to see if any malicious activity occurred.

Examine the kubelet logs on the node where the deployment was scheduled.

A monitoring team is designing a container monitoring solution for a fleet of hosts running Docker. They need to detect a container that is consuming excessive CPU and memory, as well as a container that is spawning unexpected child processes. Which two data sources should they integrate?

Kubernetes audit logs and image vulnerability scans

Host-level metrics from cAdvisor and process events from the container runtime

Container image manifests and registry pull logs

A Kubernetes cluster administrator notices that a new namespace was created with a highly privileged service account, but no deployment has been scheduled yet. The administrator wants to determine whether this was an authorized change. Which data source should be examined first?

kubelet logs on the worker nodes to see if any pods were scheduled in the new namespace.

Kubernetes audit logs for the API server, filtered by the namespace creation event and the user who initiated it.

Container runtime logs to check for any containers running with the privileged service account.

etcd logs to review the raw storage of the namespace object.

Which orchestration platform event is most likely to indicate a security incident?

A routine node drain for maintenance

A user logging into the dashboard

A new deployment with a large number of replicas

A scheduled backup of etcd data

A security team wants to detect suspicious activities in a Kubernetes cluster, such as attempts to access secrets or create privileged pods. They have enabled Kubernetes audit logging but need to ensure the logs are searchable and alerting is possible. What should they do next?

Use `kubectl auth can-i --list` to check permissions

Rely on `kubectl get events` for real-time monitoring

Enable verbose logging on each node's kubelet

Store audit logs in a central log management platform and create alerting rules

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 4)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 16–20

16expert · hard
A security engineer is investigating a suspicious Kubernetes API server request that created a new deployment with a hostPath volume. The request came from a service account used by a CI/CD pipeline. The engineer needs to determine whether the service account was compromised or the pipeline was misconfigured. Which evidence would be most decisive?
Select an answer first
17application · medium
A monitoring team is designing a container monitoring solution for a fleet of hosts running Docker. They need to detect a container that is consuming excessive CPU and memory, as well as a container that is spawning unexpected child processes. Which two data sources should they integrate?
Select an answer first
18application · medium
A Kubernetes cluster administrator notices that a new namespace was created with a highly privileged service account, but no deployment has been scheduled yet. The administrator wants to determine whether this was an authorized change. Which data source should be examined first?
Select an answer first
19foundation · easy
Which orchestration platform event is most likely to indicate a security incident?
Select an answer first
20application · medium
A security team wants to detect suspicious activities in a Kubernetes cluster, such as attempts to access secrets or create privileged pods. They have enabled Kubernetes audit logging but need to ensure the logs are searchable and alerting is possible. What should they do next?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.