In a Kubernetes cluster, a pod ran a container that performed malicious activity. The pod has been deleted, and the node has been cordoned. You need to collect forensic evidence from the node. Which approach best preserves the evidence while minimizing disruption to the cluster?

Immediately drain the node to remove all pods, then collect evidence from the node's filesystem.

Use `kubectl delete pod` to remove the pod and then collect logs from the API server.

Restart the kubelet service to ensure all container logs are flushed to disk.

Collect a memory dump and disk image of the node before any further pod deletions or node operations.

Which of the following is a key forensic artifact that resides on the host and records the commands and output from a container's main process?

Container logs (e.g., JSON-file logs)

A container is suspected of launching a fork bomb that could exhaust host resources. You need to verify whether the container's process limit was enforced. Which file on the host would you examine to confirm the cgroup's pids.max setting?

`/var/lib/docker/containers/ /config.v2.json`

`/sys/fs/cgroup/pids/ /pids.max`

A forensic analyst is examining a Linux host that runs containers. The host has both Docker and containerd installed. The analyst wants to find logs of container start/stop events that occurred before the Docker daemon was restarted. Which source is most likely to contain those historical events?

The Docker daemon logs, because Docker is the primary interface for container management.

The container's JSON logs under `/var/lib/docker/containers/`, because they capture start/stop events.

The containerd logs, because containerd manages the container lifecycle even when Docker is the client.

The kernel ring buffer (`dmesg`), because container start/stop generates kernel messages.

In a Kubernetes cluster, you need to investigate a container that ran in a pod on a node that has already been deleted. You have access to the API server and the node's disk image. Which combination of sources would give you the most complete picture of the container's execution?

The pod's YAML from the API server and the node's kubelet logs.

The container image from the registry and the pod's YAML.

The node's disk image and the container image.

The API server audit logs and the container image.

GIAC Enterprise Incident Responder

Domain 2Objective 3

Container DFIR Fundamentals GEIR Practice Questions (Page 8)

Part of the Cloud and Container Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 36–40

36expert · hard
In a Kubernetes cluster, a pod ran a container that performed malicious activity. The pod has been deleted, and the node has been cordoned. You need to collect forensic evidence from the node. Which approach best preserves the evidence while minimizing disruption to the cluster?
Select an answer first
37foundation · easy
Which of the following is a key forensic artifact that resides on the host and records the commands and output from a container's main process?
Select an answer first
38application · medium
A container is suspected of launching a fork bomb that could exhaust host resources. You need to verify whether the container's process limit was enforced. Which file on the host would you examine to confirm the cgroup's pids.max setting?
Select an answer first
39application · medium
A forensic analyst is examining a Linux host that runs containers. The host has both Docker and containerd installed. The analyst wants to find logs of container start/stop events that occurred before the Docker daemon was restarted. Which source is most likely to contain those historical events?
Select an answer first
40expert · hard
In a Kubernetes cluster, you need to investigate a container that ran in a pod on a node that has already been deleted. You have access to the API server and the node's disk image. Which combination of sources would give you the most complete picture of the container's execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.