Container DFIR Fundamentals GEIR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the forensic value of container runtime logs (e.g., containerd logs)?

   • AThey contain the full contents of the container's filesystem
   • BThey can provide a timeline of container lifecycle events and errors
   • CThey include the container's network traffic payloads
   • DThey provide a backup of the container image
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During incident response on a compromised Linux host, you identify a suspicious process with PID 4821 that appears to be running inside a container. You need to confirm which container it belongs to and map it to the container's filesystem and network namespace. Which command sequence would provide the most direct evidence for this mapping?

   • ARun `docker inspect --format '{{.State.Pid}}' <container>` for each container, then compare the output to PID 4821.
   • BRun `ls -la /proc/4821/root` and compare the inode numbers with `docker inspect` output for each container's root filesystem.
   • CRun `cat /proc/4821/cgroup` to read the cgroup path, then use `docker ps -q` and `docker inspect` to match the cgroup ID to a container.
   • DRun `nsenter -t 4821 -n ip addr` to view the network namespace, then search `docker network inspect` output for the same IP address.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are investigating a Kubernetes cluster where a container was killed by the OOM killer. You need to determine which process in the container was responsible for the memory exhaustion. Which source would provide the most direct evidence?

   • AThe container's stdout/stderr logs, which may contain application-level error messages about memory allocation failures.
   • BThe kernel's system log (e.g., `dmesg` or `/var/log/kern.log`), which records OOM killer events with the PID and process name.
   • CThe Kubernetes event log, which records the pod's OOMKilled status but not the specific process.
   • DThe container's cgroup memory statistics, which show usage but not which process caused the OOM.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which component is responsible for actually launching and supervising container processes on a Linux host?

   • AContainer orchestrator
   • BContainer registry
   • CContainer runtime
   • DContainer image builder
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are investigating a Kubernetes node that uses CRI-O as its container runtime. You need to collect the container's logs and configuration for forensic analysis. Which command or tool would be most appropriate for this task?

   • AUse `ctr logs <container>` and `ctr inspect <container>` to collect logs and configuration.
   • BUse `kubectl logs <pod>` and `kubectl describe pod <pod>` to collect logs and configuration.
   • CUse `crictl logs <container>` and `crictl inspect <container>` to collect logs and configuration.
   • DUse `docker logs <container>` and `docker inspect <container>` to collect logs and configuration.
   Reveal Solution Discussion Select an answer first