A monitoring alert fires because a pod's CPU usage has spiked to 95% for over 10 minutes. The pod is a customer-facing web service. The team needs to determine if this is a denial-of-service attack or a memory leak in the application. Which additional metric would be most helpful?

Network ingress packet rate to the pod

Number of replicas in the deployment

A security analyst is tuning a container threat detection system. The system currently generates many false positives from a legitimate batch job that runs heavy computations. The analyst wants to reduce false positives while still detecting anomalous behavior. Which approach is most effective?

Switch from behavioral detection to signature-based detection only.

Increase the severity threshold for all alerts globally.

Create a behavioral baseline for the batch job and alert on deviations from that baseline.

Disable all alerts for the batch job's namespace to reduce noise.

What is a primary security concern when monitoring container storage and volumes?

Unauthorized access to sensitive data stored in volumes

Counting the number of pods in a namespace

A security analyst notices that the Kubernetes API server is responding slowly and there are many requests to list all secrets in the cluster. The requests originate from a single service account that normally only reads pod logs. Which action should the analyst take first to determine if this is malicious?

Restart the API server to clear the load

Check the service account's token expiration

Block the service account's access to the API server immediately

Review the API server audit logs to see the full request pattern and source IPs

What is the primary purpose of monitoring container image registries?

To detect unauthorized access and tampering of stored images

To manage Kubernetes pod scheduling

To monitor runtime process execution

To track network traffic between containers

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 5)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 21–25

21application · medium
A monitoring alert fires because a pod's CPU usage has spiked to 95% for over 10 minutes. The pod is a customer-facing web service. The team needs to determine if this is a denial-of-service attack or a memory leak in the application. Which additional metric would be most helpful?
Select an answer first
22application · medium
A security analyst is tuning a container threat detection system. The system currently generates many false positives from a legitimate batch job that runs heavy computations. The analyst wants to reduce false positives while still detecting anomalous behavior. Which approach is most effective?
Select an answer first
23foundation · easy
What is a primary security concern when monitoring container storage and volumes?
Select an answer first
24expert · hard
A security analyst notices that the Kubernetes API server is responding slowly and there are many requests to list all secrets in the cluster. The requests originate from a single service account that normally only reads pod logs. Which action should the analyst take first to determine if this is malicious?
Select an answer first
25foundation · easy
What is the primary purpose of monitoring container image registries?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.