A Kubernetes cluster in GCP experienced a container breakout. The IR team needs to identify which container image was used and what commands were executed inside the container. Which combination of artifacts should they collect?

Only the container's stdout logs from the API server

The worker node's OS audit logs only

GCP VPC flow logs and Cloud DNS logs

Pod definition, container image ID, and kubelet logs

A company's GCP environment has a compromised VM that is communicating with a known C2 server. The IR team needs to capture the actual payload of the communication for analysis, but VPC flow logs are already enabled. Which additional action is required?

Analyze VPC flow logs for the C2 IP

Check the VM's serial console output

Enable packet mirroring on the VM's VPC network

A company uses a multi-tenant cloud provider. During an investigation, the responder needs to acquire evidence from a VM that shares physical hardware with other customers. Which legal or technical challenge is MOST relevant?

Ensuring the VM's IP address is static.

Ensuring that evidence acquisition does not expose other tenants' data.

Obtaining the physical hard drive from the provider.

Confirming the VM's operating system version.

A company's incident response plan for its Azure environment is being updated. The plan must address the shared responsibility model. Which element should the plan include to ensure the IR team can effectively respond to a PaaS incident?

Procedures for patching the hypervisor

Procedures for modifying the underlying network infrastructure

Procedures for accessing application-level logs and metrics

Procedures for capturing memory dumps from the host OS

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 10)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 46–50

46application · medium
A Kubernetes cluster in GCP experienced a container breakout. The IR team needs to identify which container image was used and what commands were executed inside the container. Which combination of artifacts should they collect?
Select an answer first
47expert · hard
A company's GCP environment has a compromised VM that is communicating with a known C2 server. The IR team needs to capture the actual payload of the communication for analysis, but VPC flow logs are already enabled. Which additional action is required?
Select an answer first
48foundation · easy
Which cloud-native log service is specifically designed to record API activity in AWS, such as who made a request and what action was taken?
Select an answer first
49expert · hard
A company uses a multi-tenant cloud provider. During an investigation, the responder needs to acquire evidence from a VM that shares physical hardware with other customers. Which legal or technical challenge is MOST relevant?
Select an answer first
50expert · hard
A company's incident response plan for its Azure environment is being updated. The plan must address the shared responsibility model. Which element should the plan include to ensure the IR team can effectively respond to a PaaS incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.