A company's security policy requires that all container images run as non-root and that no privileged containers are deployed. The security team needs to continuously monitor the Kubernetes cluster to ensure compliance. Which control provides the most direct enforcement and monitoring?

Run a periodic vulnerability scan on all images in the registry.

Monitor Kubernetes audit logs for any pod creation events and manually review them.

Use a runtime security tool that alerts when a container runs as root.

Implement an admission controller (e.g., OPA/Gatekeeper) that rejects pods violating the non-root and no-privileged policies.

A security analyst is investigating a potential data exfiltration from a Kubernetes cluster. The cluster uses a network policy that restricts egress to specific external IPs. However, the analyst notices that a compromised pod is communicating with an IP not on the allowlist. The network policy is enforced by a CNI plugin. Which monitoring data would best confirm whether the network policy was bypassed or misconfigured?

Check the pod's security context to see if it has hostNetwork enabled.

Review the Kubernetes audit logs for changes to the network policy.

Examine the container runtime logs for any network namespace changes.

Compare the CNI plugin's network policy enforcement logs with the actual flow logs from the pod.

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 8)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 36–40

36foundation · easy
Which control plane component should be monitored for suspicious scheduling decisions?
Select an answer first
37application · medium
A company's security policy requires that all container images run as non-root and that no privileged containers are deployed. The security team needs to continuously monitor the Kubernetes cluster to ensure compliance. Which control provides the most direct enforcement and monitoring?
Select an answer first
38expert · hard
A security analyst is investigating a potential data exfiltration from a Kubernetes cluster. The cluster uses a network policy that restricts egress to specific external IPs. However, the analyst notices that a compromised pod is communicating with an IP not on the allowlist. The network policy is enforced by a CNI plugin. Which monitoring data would best confirm whether the network policy was bypassed or misconfigured?
Select an answer first
39foundation · easy
Which resource usage metric is commonly monitored at the container runtime level to detect resource abuse?
Select an answer first
40foundation · easy
Which threat detection technique is most effective for detecting known malware in container images?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Containers and Orchestration GCTD Practice Questions (Page 8)

Questions 36–40

Which control plane component should be monitored for suspicious scheduling decisions?

A company's security policy requires that all container images run as non-root and that no privileged containers are deployed. The security team needs to continuously monitor the Kubernetes cluster to ensure compliance. Which control provides the most direct enforcement and monitoring?

Which resource usage metric is commonly monitored at the container runtime level to detect resource abuse?

Which threat detection technique is most effective for detecting known malware in container images?

Keep studying — Cloud Infrastructure Monitoring