You are investigating a container that is communicating with a known command-and-control server. You need to identify the host process that is responsible for the network connection. The container uses the default bridge network. Which command sequence would you use on the host?

Run `tcpdump -i docker0` and capture traffic to the C2 IP.

Run `docker logs ` and look for the C2 IP in the logs.

Run `netstat -tunap` on the host and look for connections to the C2 IP.

Run `docker inspect ` to get the container PID, then run `ss -tunap | grep ` to find its network connections.

You are analyzing a container that was suspected of launching a resource exhaustion attack. The container has been stopped, and you need to determine if it exceeded its CPU or memory limits. Which artifact would provide the most direct evidence of the container's resource usage during its lifetime?

The Docker daemon logs, which record when limits were set but not actual usage over time.

The container's cgroup statistics, which are stored in `/sys/fs/cgroup/cpu/` and `/sys/fs/cgroup/memory/` and include usage counters.

The container's image layers, which contain the application code but not runtime resource usage data.

The container's stdout/stderr logs, which may contain application-level resource usage information.

You are responding to an incident in a Kubernetes cluster where a pod was deleted by an attacker. You need to collect forensic evidence about the pod's container, but the pod has already been removed from the API server. Which source would still contain evidence about the container's existence and configuration?

The container runtime's storage directory (e.g., `/var/lib/containerd/`), which may retain the container's metadata and logs even after the pod is deleted.

The kubelet's pod cache, which stores pod specifications but is cleared when the pod is deleted.

The etcd database, which stores pod specifications but is the source of truth for the API server and may not retain deleted pod data.

The Kubernetes API server audit logs, which record the pod deletion request but not the container's filesystem or runtime details.

A container was started and then immediately stopped. You need to determine the exact command that was used to start the container. Which source would provide this information?

The container's config file at `/var/lib/docker/containers/ /config.v2.json`.

During a forensic investigation of a Kubernetes node, you find a container that was running with `hostPID: true` and `hostNetwork: true`. The container's process list shows a process with a host PID that corresponds to the kubelet. Which conclusion is most defensible based on these findings?

The container is running in privileged mode because it can access the host network and PID namespace.

The container has escaped its isolation and is directly executing code in the host's init namespace.

The container was configured with weakened isolation, and the process visible in the container's PID namespace is actually a host process.

The container has definitely been compromised because it can see the kubelet process.

GIAC Enterprise Incident Responder

Domain 2Objective 3

Container DFIR Fundamentals GEIR Practice Questions (Page 3)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 11–15

11application · medium
You are investigating a container that is communicating with a known command-and-control server. You need to identify the host process that is responsible for the network connection. The container uses the default bridge network. Which command sequence would you use on the host?
Select an answer first
12application · medium
You are analyzing a container that was suspected of launching a resource exhaustion attack. The container has been stopped, and you need to determine if it exceeded its CPU or memory limits. Which artifact would provide the most direct evidence of the container's resource usage during its lifetime?
Select an answer first
13expert · hard
You are responding to an incident in a Kubernetes cluster where a pod was deleted by an attacker. You need to collect forensic evidence about the pod's container, but the pod has already been removed from the API server. Which source would still contain evidence about the container's existence and configuration?
Select an answer first
14application · medium
A container was started and then immediately stopped. You need to determine the exact command that was used to start the container. Which source would provide this information?
Select an answer first
15expert · hard
During a forensic investigation of a Kubernetes node, you find a container that was running with `hostPID: true` and `hostNetwork: true`. The container's process list shows a process with a host PID that corresponds to the kubelet. Which conclusion is most defensible based on these findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.