During an incident, you need to acquire the full filesystem of a compromised container that is still running on a Docker host. The container uses the default overlay2 storage driver. Which approach preserves the most forensic value from the container's writable layer?

Run `docker commit` to create an image from the container, then `docker save` that image to a tar file.

Use `docker cp` to copy the entire root filesystem from the container to the host.

Pause the container with `docker pause`, then use `docker export` to create a tar archive of the container's filesystem.

Copy the container's merged directory from `/var/lib/docker/overlay2/ /merged` using `cp -a` while the container is running.

You are investigating a container image that was pulled from a private registry. You need to analyze the image's layers to determine if a malicious file was added in a specific layer. Which approach gives you the ability to examine each layer individually?

Use `docker inspect` to view the layer IDs and then access them directly under `/var/lib/docker/overlay2/`.

Use `docker history ` to list the layers and then `docker export` each layer to a tar file.

Run `docker run` the image and use `docker cp` to copy files from the container.

Pull the image with `docker pull`, then use `docker save` to create a tar archive and extract each layer directory from it.

In a container image, what is the primary purpose of the writable layer created when a container starts?

To store the container's network configuration

To hold the base operating system files

To store changes made during the container's runtime

To contain the container's metadata and labels

GIAC Enterprise Incident Responder

Domain 2Objective 3

Container DFIR Fundamentals GEIR Practice Questions (Page 4)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 16–20

16application · medium
During an incident, you need to acquire the full filesystem of a compromised container that is still running on a Docker host. The container uses the default overlay2 storage driver. Which approach preserves the most forensic value from the container's writable layer?
Select an answer first
17foundation · easy
Which container runtime is commonly used by Kubernetes as a lightweight, high-level runtime that manages image transfer and container lifecycle, but delegates process execution to a lower-level runtime?
Select an answer first
18application · medium
You are investigating a container image that was pulled from a private registry. You need to analyze the image's layers to determine if a malicious file was added in a specific layer. Which approach gives you the ability to examine each layer individually?
Select an answer first
19foundation · easy
In a container image, what is the primary purpose of the writable layer created when a container starts?
Select an answer first
20foundation · easy
Which Linux namespace is primarily responsible for isolating a container's filesystem view?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Container DFIR Fundamentals GEIR Practice Questions (Page 4)

Questions 16–20

During an incident, you need to acquire the full filesystem of a compromised container that is still running on a Docker host. The container uses the default overlay2 storage driver. Which approach preserves the most forensic value from the container's writable layer?

Which container runtime is commonly used by Kubernetes as a lightweight, high-level runtime that manages image transfer and container lifecycle, but delegates process execution to a lower-level runtime?

You are investigating a container image that was pulled from a private registry. You need to analyze the image's layers to determine if a malicious file was added in a specific layer. Which approach gives you the ability to examine each layer individually?

In a container image, what is the primary purpose of the writable layer created when a container starts?

Which Linux namespace is primarily responsible for isolating a container's filesystem view?

Keep studying — Cloud and Container Forensics