During a forensic analysis of a container image, you need to determine which layer introduced a specific malicious file. You have access to the image's manifest and the host's overlay2 directory. Which approach would most efficiently identify the layer containing the file?

Inspect the overlay2 directory and compare file inodes across the layer directories.

Extract each layer from the image manifest and search for the file in each layer's tar archive.

Use `docker history ` to list the layers and their creation commands, then infer which layer likely contains the file.

Run `docker diff ` on a container created from the image to see which files were changed.

During a forensic review of a compromised container, you find that the container was running with `--privileged` and had the `CAP_SYS_ADMIN` capability. The container also had a mount namespace that included the host's `/etc` directory. Which finding is the strongest indicator of a potential container escape?

The container was running with `--privileged`, which alone proves it escaped.

The container had a cgroup limit set, which is a sign of escape because cgroups are a host resource.

The container had `CAP_SYS_ADMIN` and a host mount, which together could allow it to manipulate host mounts or access sensitive files.

The container had access to the host's `/etc` directory, which is definitive evidence of compromise.

What is the primary purpose of control groups (cgroups) in container technology?

To manage the container's hostname and domain name

To provide a separate network stack for each container

To isolate the container's filesystem from the host

To limit and monitor resource usage such as CPU, memory, and I/O

You need to determine whether a container shares the host's network namespace. Which command would you run on the host to check this?

`docker inspect --format '{{.HostConfig.NetworkMode}}'`

GIAC Enterprise Incident Responder

Domain 2Objective 3

Container DFIR Fundamentals GEIR Practice Questions (Page 6)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 26–30

26application · medium
During a forensic analysis of a container image, you need to determine which layer introduced a specific malicious file. You have access to the image's manifest and the host's overlay2 directory. Which approach would most efficiently identify the layer containing the file?
Select an answer first
27foundation · easy
Which cgroup subsystem would an investigator examine to determine the memory limit assigned to a container?
Select an answer first
28expert · hard
During a forensic review of a compromised container, you find that the container was running with `--privileged` and had the `CAP_SYS_ADMIN` capability. The container also had a mount namespace that included the host's `/etc` directory. Which finding is the strongest indicator of a potential container escape?
Select an answer first
29foundation · easy
What is the primary purpose of control groups (cgroups) in container technology?
Select an answer first
30application · medium
You need to determine whether a container shares the host's network namespace. Which command would you run on the host to check this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Container DFIR Fundamentals GEIR Practice Questions (Page 6)

Questions 26–30

During a forensic analysis of a container image, you need to determine which layer introduced a specific malicious file. You have access to the image's manifest and the host's overlay2 directory. Which approach would most efficiently identify the layer containing the file?

Which cgroup subsystem would an investigator examine to determine the memory limit assigned to a container?

What is the primary purpose of control groups (cgroups) in container technology?

You need to determine whether a container shares the host's network namespace. Which command would you run on the host to check this?

Keep studying — Cloud and Container Forensics