What is the first step in incident response for a compromised container?

Isolate the container to prevent further spread

Delete the container immediately

Rebuild the container from the same image

A security team is tuning a container runtime anomaly detection system. They are getting many false positives from a batch processing application that normally uses high CPU and makes many network connections. The team wants to reduce false positives without missing real threats. Which approach is most effective?

Create a baseline profile for the batch application and exclude it from anomaly detection

Adjust anomaly thresholds based on the application's historical behavior

Disable anomaly detection for all containers running as root

Increase the alert severity level for all anomalies

During a container security incident, the response team needs to preserve evidence for legal proceedings. The compromised container has already been stopped, but the host is still running. Which evidence source is most likely to provide a court-admissible record of the container's activities?

The Kubernetes deployment YAML file

The container's writable layer from the host filesystem

Container stdout logs collected by the logging agent

Memory dump of the stopped container

GIAC Cloud Threat Detection

Domain 2Objective 2

Containers and Orchestration GCTD Practice Questions (Page 9)

Part of the Cloud Infrastructure Monitoring domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 41–45

41foundation · easy
What is the first step in incident response for a compromised container?
Select an answer first
42expert · hard
A security team is tuning a container runtime anomaly detection system. They are getting many false positives from a batch processing application that normally uses high CPU and makes many network connections. The team wants to reduce false positives without missing real threats. Which approach is most effective?
Select an answer first
43foundation · easy
Which Kubernetes workload component is a logical grouping of pods that provides a stable network endpoint?
Select an answer first
44foundation · easy
Which Kubernetes control plane component is responsible for validating and processing API requests?
Select an answer first
45expert · hard
During a container security incident, the response team needs to preserve evidence for legal proceedings. The compromised container has already been stopped, but the host is still running. Which evidence source is most likely to provide a court-admissible record of the container's activities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Containers and Orchestration GCTD Practice Questions (Page 9)

Questions 41–45

What is the first step in incident response for a compromised container?

Which Kubernetes workload component is a logical grouping of pods that provides a stable network endpoint?

Which Kubernetes control plane component is responsible for validating and processing API requests?

During a container security incident, the response team needs to preserve evidence for legal proceedings. The compromised container has already been stopped, but the host is still running. Which evidence source is most likely to provide a court-admissible record of the container's activities?

Keep studying — Cloud Infrastructure Monitoring