A Kubernetes cluster is compromised. The responder needs to determine which container image was running at the time of the incident. The pod has been restarted multiple times. Which source provides the most reliable historical record?

The container runtime logs on the node.

The image digest from the container registry.

The pod's YAML file in the Git repository.

Kubernetes events and pod status in etcd.

A company is preparing its incident response plan for a cloud environment. Which activity is MOST important during the preparation phase?

Ensure that IAM roles and permissions allow responders to access logs and snapshots across accounts.

Document the physical location of all cloud data centers.

Create a list of all employees' personal devices.

Purchase additional cloud capacity for forensic analysis.

An incident responder needs to acquire memory from a compromised GCP VM. The VM is running a critical production workload that cannot be stopped. Which method preserves memory evidence with the least impact?

Use GCP's built-in memory dump feature.

Use a memory acquisition tool (e.g., LiME) over SSH to capture memory to a remote location.

Take a snapshot of the VM's disk and analyze the swap file.

Live-migrate the VM to another host and then acquire memory from the hypervisor.

An AWS account has a compromised IAM role that is being used to launch unauthorized EC2 instances. The IR team wants to contain the incident while preserving the ability to investigate the role's past activity. Which action best achieves this?

Attach a restrictive IAM policy to the role that denies ec2:RunInstances

Delete the IAM role immediately

Rotate the access keys of the role

Disable the role's permissions boundary

GIAC Enterprise Incident Responder

Domain 2Objective 2

Cloud Response and Analysis GEIR Practice Questions (Page 8)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
Which cloud feature provides metadata about network traffic, such as source and destination IPs, ports, and protocol, but does not capture the actual payload?
Select an answer first
37expert · hard
A Kubernetes cluster is compromised. The responder needs to determine which container image was running at the time of the incident. The pod has been restarted multiple times. Which source provides the most reliable historical record?
Select an answer first
38application · medium
A company is preparing its incident response plan for a cloud environment. Which activity is MOST important during the preparation phase?
Select an answer first
39expert · hard
An incident responder needs to acquire memory from a compromised GCP VM. The VM is running a critical production workload that cannot be stopped. Which method preserves memory evidence with the least impact?
Select an answer first
40expert · hard
An AWS account has a compromised IAM role that is being used to launch unauthorized EC2 instances. The IR team wants to contain the incident while preserving the ability to investigate the role's past activity. Which action best achieves this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.