A security team notices that a Kubernetes cluster has an unusually high number of failed API server authentication attempts from a single service account, followed by a successful login and a change to a cluster role binding. The team needs to determine whether this is an attack or a misconfigured automation script. Which evidence would be most useful to make that determination?

Review the container image used by the pod associated with the service account

Compare the timing of the failed attempts to the automation script's scheduled job logs

Examine the network flow logs for connections to the API server from unexpected IP addresses

Check the service account's permissions to see if it is allowed to modify role bindings

What is the purpose of container compliance monitoring?

To monitor container performance metrics

To manage container image builds

To ensure containers adhere to security policies and regulatory requirements

A security analyst is investigating a potential lateral movement from a compromised pod to other pods in the same Kubernetes cluster. The cluster uses a service mesh with mTLS enabled. Which monitoring data would provide the most useful evidence of east-west traffic between pods?

Container runtime logs showing the compromised pod's file system activity.

Service mesh sidecar proxy logs showing source and destination pod identities and connection metadata.

Host-level network captures on the worker node using tcpdump.

Kubernetes service logs showing which services were accessed by the compromised pod.

A containerized application writes sensitive files to a persistent volume. The security team wants to detect if an attacker who gains access to the container attempts to read or exfiltrate those files. Which monitoring approach would provide the most direct detection?

Monitor file access logs on the host for the volume's mount point

Monitor container CPU and memory usage for anomalies

Monitor Kubernetes events for volume mount/unmount operations

Monitor container image pull logs

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 6)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 26–30

26expert · hard
A security team notices that a Kubernetes cluster has an unusually high number of failed API server authentication attempts from a single service account, followed by a successful login and a change to a cluster role binding. The team needs to determine whether this is an attack or a misconfigured automation script. Which evidence would be most useful to make that determination?
Select an answer first
27foundation · easy
What is the purpose of container compliance monitoring?
Select an answer first
28application · medium
A security analyst is investigating a potential lateral movement from a compromised pod to other pods in the same Kubernetes cluster. The cluster uses a service mesh with mTLS enabled. Which monitoring data would provide the most useful evidence of east-west traffic between pods?
Select an answer first
29foundation · easy
In a container infrastructure, which component is responsible for executing container processes and isolating them from the host operating system?
Select an answer first
30application · medium
A containerized application writes sensitive files to a persistent volume. The security team wants to detect if an attacker who gains access to the container attempts to read or exfiltrate those files. Which monitoring approach would provide the most direct detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Containers and Orchestration GCTD Practice Questions (Page 6)

Questions 26–30

What is the purpose of container compliance monitoring?

A security analyst is investigating a potential lateral movement from a compromised pod to other pods in the same Kubernetes cluster. The cluster uses a service mesh with mTLS enabled. Which monitoring data would provide the most useful evidence of east-west traffic between pods?

In a container infrastructure, which component is responsible for executing container processes and isolating them from the host operating system?

A containerized application writes sensitive files to a persistent volume. The security team wants to detect if an attacker who gains access to the container attempts to read or exfiltrate those files. Which monitoring approach would provide the most direct detection?

Keep studying — Cloud Infrastructure Monitoring