A GCP Compute Engine instance was compromised. The incident responder needs to determine which IAM roles the instance's service account had at the time of the incident. Which source provides the most accurate historical view of the service account's permissions?

IAM policy bindings from the project's IAM page

The instance's metadata server response

Cloud Audit Logs for the 'SetIamPolicy' operations

The service account key file stored on the instance

A Kubernetes cluster in EKS experienced a security incident. The IR team needs to determine which user or service account executed a `kubectl exec` command into a pod. Which log source should they analyze?

Container runtime logs (e.g., containerd)

Kubernetes API server audit logs

EKS control plane logs for the kube-controller-manager

AWS CloudTrail for EKS API calls

An Azure VM is suspected of running cryptocurrency miners. The IR team wants to preserve forensic evidence without altering the VM's state. Which action should they take first?

Export the VM's activity log to a storage account

Attach a data disk and copy the VM's memory

Deploy Azure Bastion and run dd on the live VM

Create a snapshot of the OS and data disks

A Kubernetes cluster in AKS is suspected of running a malicious container. The responder needs to preserve evidence of the container's filesystem and runtime behavior without stopping the pod. Which action is most appropriate?

Execute 'kubectl exec' to run commands inside the container to inspect running processes.

Delete the pod and rely on the container image for analysis.

Take a snapshot of the entire node's disk.

Use 'kubectl cp' to copy the container's filesystem to a forensic workstation.

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 4)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 16–20

16application · medium
A GCP Compute Engine instance was compromised. The incident responder needs to determine which IAM roles the instance's service account had at the time of the incident. Which source provides the most accurate historical view of the service account's permissions?
Select an answer first
17expert · hard
A Kubernetes cluster in EKS experienced a security incident. The IR team needs to determine which user or service account executed a `kubectl exec` command into a pod. Which log source should they analyze?
Select an answer first
18application · medium
An Azure VM is suspected of running cryptocurrency miners. The IR team wants to preserve forensic evidence without altering the VM's state. Which action should they take first?
Select an answer first
19foundation · easy
Which phase of the cloud incident response process involves actions such as taking snapshots, preserving logs, and isolating the affected instance to prevent further damage?
Select an answer first
20application · medium
A Kubernetes cluster in AKS is suspected of running a malicious container. The responder needs to preserve evidence of the container's filesystem and runtime behavior without stopping the pod. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.