You are analyzing a container image that was pulled from a public registry. You suspect that a malicious file was added in a later layer, overwriting a legitimate file from an earlier layer. Which approach would best confirm this and identify the malicious layer?

Compare the file's hash in the final image with the hash in each layer's tar archive.

Use `docker history ` to see the commands that created each layer and infer which one modified the file.

Run `docker diff` on a container created from the image to see which files were changed.

Use `docker inspect` to view the image's configuration and identify the layer that added the file.

You need to acquire a container image from a private registry for offline forensic analysis. The registry requires authentication, and you have valid credentials. Which approach would be most appropriate for acquiring the image while preserving its integrity?

Use `docker history ` to list the layers, then manually download each layer from the registry.

Use `docker export ` to export the container's filesystem as a tar archive.

Use `docker commit ` to create a new image from a container, then save it.

Use `docker pull ` to download the image, then use `docker save -o image.tar ` to export it.

GIAC Enterprise Incident Responder

Domain 2Objective 3

Container DFIR Fundamentals GEIR Practice Questions (Page 10)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 46–47

46expert · hard
You are analyzing a container image that was pulled from a public registry. You suspect that a malicious file was added in a later layer, overwriting a legitimate file from an earlier layer. Which approach would best confirm this and identify the malicious layer?
Select an answer first
47application · medium
You need to acquire a container image from a private registry for offline forensic analysis. The registry requires authentication, and you have valid credentials. Which approach would be most appropriate for acquiring the image while preserving its integrity?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Container DFIR Fundamentals GEIR Practice Questions (Page 10)

Questions 46–47

You are analyzing a container image that was pulled from a public registry. You suspect that a malicious file was added in a later layer, overwriting a legitimate file from an earlier layer. Which approach would best confirm this and identify the malicious layer?

You need to acquire a container image from a private registry for offline forensic analysis. The registry requires authentication, and you have valid credentials. Which approach would be most appropriate for acquiring the image while preserving its integrity?

Keep studying — Cloud and Container Forensics