Container DFIR Fundamentals GEIR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are analyzing a container image that has multiple layers. You need to determine which layer introduced a specific binary. The image is stored locally on the Docker host. Which method lets you inspect the contents of each layer without running the container?

   • AUse `docker run` the image and then `docker diff` to see changes.
   • BUse `docker history` to see the layer sizes and creation commands.
   • CUse `docker save` to export the image as a tar archive, then extract and examine each layer's filesystem.
   • DUse `docker inspect` to view the layer IDs and then access them in the overlay2 directory.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does Kubernetes' automatic container rescheduling affect forensic data collection?

   • AIt can cause containers to be deleted and recreated, losing ephemeral data
   • BIt preserves all container logs and filesystem layers for later analysis
   • CIt automatically snapshots the container's memory before termination
   • DIt prevents any forensic evidence from being collected
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a common indicator of a container escape attempt?

   • AThe container image having multiple layers
   • BA process inside the container accessing host-only filesystem paths like /etc/shadow
   • CThe container using a bridge network
   • DThe container's PID 1 process having a different PID inside the container
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which command or API provides a stream of lifecycle events (e.g., container start, stop, destroy) from the Docker daemon?

   • Adocker logs
   • Bdocker inspect
   • Cdocker events
   • Ddocker stats
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are investigating a security incident in a Kubernetes cluster. You need to determine when a specific container was started and whether it was restarted after a crash. Which source would provide the most reliable timeline of container lifecycle events for this analysis?

   • AThe container's stdout/stderr logs, which are captured by the container runtime and stored in `/var/log/containers/`.
   • BThe container runtime's event stream (e.g., `docker events` or `ctr events`), which records container start, stop, and restart events.
   • CThe container's JSON state file in `/var/lib/docker/containers/<id>/`, which contains the current state but not a history of events.
   • DThe Kubernetes event log, which records pod lifecycle events such as creation, scheduling, and container restarts.
   Reveal Solution Discussion Select an answer first