A pod in a production cluster is exhibiting a pattern of rapid restarts. The security team suspects the container is being killed by a liveness probe failure, but they also see a spike in outbound network traffic just before each restart. Which investigation step would best determine whether the restarts are caused by a malicious process or an application bug?

Check the pod's resource limits

Delete the deployment and recreate it

Increase the liveness probe timeout to prevent restarts

Examine the container logs from the previous instance and correlate with network flow logs

A security team wants to centralize logs from multiple Kubernetes clusters, including API server audit logs, kubelet logs, and container stdout/stderr. The solution must support real-time alerting and long-term retention for compliance. Which approach best meets these requirements?

Configure each cluster to send logs to a central SIEM via Fluentd or similar agent

Enable Kubernetes audit logging and store logs in etcd

Store logs locally on each node and rotate them weekly

Use `kubectl logs` on demand for each pod

What is the primary benefit of aggregating container logs into a central platform?

It automatically patches container vulnerabilities.

It eliminates the need for runtime monitoring.

It enables correlation of events across multiple containers and hosts.

It reduces the need for network monitoring.

A security team is evaluating threat detection for containers. They need to detect both known malware (e.g., crypto miners) and novel attacks that use unusual system call patterns. They have limited budget and want a single solution that covers both. Which approach is most effective?

Use only signature-based scanning of container images

Combine image scanning with runtime behavioral monitoring using eBPF

Rely on Kubernetes audit logs for all detection

Use only behavioral anomaly detection on runtime syscalls

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 7)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 31–35

31expert · hard
A pod in a production cluster is exhibiting a pattern of rapid restarts. The security team suspects the container is being killed by a liveness probe failure, but they also see a spike in outbound network traffic just before each restart. Which investigation step would best determine whether the restarts are caused by a malicious process or an application bug?
Select an answer first
32foundation · easy
What is a key workload-level metric to monitor for abnormal behavior in Kubernetes?
Select an answer first
33application · medium
A security team wants to centralize logs from multiple Kubernetes clusters, including API server audit logs, kubelet logs, and container stdout/stderr. The solution must support real-time alerting and long-term retention for compliance. Which approach best meets these requirements?
Select an answer first
34foundation · easy
What is the primary benefit of aggregating container logs into a central platform?
Select an answer first
35expert · hard
A security team is evaluating threat detection for containers. They need to detect both known malware (e.g., crypto miners) and novel attacks that use unusual system call patterns. They have limited budget and want a single solution that covers both. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Containers and Orchestration GCTD Practice Questions (Page 7)

Questions 31–35

What is a key workload-level metric to monitor for abnormal behavior in Kubernetes?

A security team wants to centralize logs from multiple Kubernetes clusters, including API server audit logs, kubelet logs, and container stdout/stderr. The solution must support real-time alerting and long-term retention for compliance. Which approach best meets these requirements?

What is the primary benefit of aggregating container logs into a central platform?

A security team is evaluating threat detection for containers. They need to detect both known malware (e.g., crypto miners) and novel attacks that use unusual system call patterns. They have limited budget and want a single solution that covers both. Which approach is most effective?

Keep studying — Cloud Infrastructure Monitoring