How does OverlayFS combine the read-only layers of a container image with the writable layer?

It stores the writable layer in memory and the read-only layers on disk

It creates a separate mount point for each layer, and the container accesses them individually

It copies all read-only layers into the writable layer at container start

It merges them into a single unified view, with the writable layer on top

A security analyst needs to determine which host processes belong to a specific container that is suspected of network reconnaissance. The container was started with Docker using the default network mode. Which combination of commands provides the most direct mapping of container processes to host processes and associated network connections?

Run `docker logs ` to review the container's network activity logs.

Run `docker inspect ` and parse the `NetworkSettings` section to find the container IP, then use `tcpdump` on the host to capture traffic to that IP.

Run `ps aux` on the host and filter for the container's image name in the command line.

Run `docker top ` to list host PIDs, then use `ss -tunap` on the host to correlate those PIDs with network connections.

A container on a Linux host is suspected of performing network scanning. The container was started with the default Docker network mode. Which host-level command would let you capture the container's outbound network traffic and associate it with the container's network namespace?

Run `docker logs ` to view network activity logs.

Run `tcpdump -i docker0` to capture traffic on the bridge interface.

Run `tcpdump -i any` on the host and filter by the container's IP address.

Run `nsenter -t -n tcpdump -i eth0` to capture traffic inside the container's network namespace.

Which tool can be used to capture network traffic associated with a specific container's network namespace?

tcpdump with the container's network namespace

What is the primary role of a container orchestrator like Kubernetes?

To secure the host operating system

To build container images from source code

To automate deployment, scaling, and management of containerized applications

To provide a graphical interface for managing individual containers

GIAC Enterprise Incident Responder

Domain 2Objective 3

Container DFIR Fundamentals GEIR Practice Questions (Page 7)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
How does OverlayFS combine the read-only layers of a container image with the writable layer?
Select an answer first
32application · medium
A security analyst needs to determine which host processes belong to a specific container that is suspected of network reconnaissance. The container was started with Docker using the default network mode. Which combination of commands provides the most direct mapping of container processes to host processes and associated network connections?
Select an answer first
33application · medium
A container on a Linux host is suspected of performing network scanning. The container was started with the default Docker network mode. Which host-level command would let you capture the container's outbound network traffic and associate it with the container's network namespace?
Select an answer first
34foundation · easy
Which tool can be used to capture network traffic associated with a specific container's network namespace?
Select an answer first
35foundation · easy
What is the primary role of a container orchestrator like Kubernetes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.