CDP Continuous Monitoring & Incident Response 3 â Questions and Answers
Question 1: Which artifact should be preserved FIRST when performing forensic analysis after a container compromise?
- Container image layers
- Running container memory snapshot and filesystem (Correct answer)
- CI/CD pipeline logs
- Kubernetes RBAC configuration
Correct answer: Running container memory snapshot and filesystem
A running container's volatile memory and ephemeral filesystem hold live attack evidence that is permanently lost once the container is stopped.
Question 2: What is the role of threat intelligence feeds in continuous monitoring?
- Automating patch deployment to vulnerable systems
- Enriching alerts with known attacker TTPs and IOCs to prioritize response (Correct answer)
- Generating compliance reports for auditors
- Training developers on secure coding practices
Correct answer: Enriching alerts with known attacker TTPs and IOCs to prioritize response
Threat intelligence feeds supply indicators of compromise (IOCs) and tactics that help analysts decide which alerts represent real, active threats.
Question 3: A DevSecOps team receives an alert that a build server is communicating with a known command-and-control IP. Which incident response phase does the initial triage belong to?
- Eradication
- Identification (Correct answer)
- Recovery
- Lessons learned
Correct answer: Identification
Triage determines whether an alert represents a real incident, which is the identification phase of the NIST incident response lifecycle.
Question 4: Which practice reduces alert fatigue in a security operations center monitoring a DevSecOps pipeline?
- Increasing alert thresholds to reduce volume
- Tuning alert rules using baselines and suppressing known-good patterns (Correct answer)
- Disabling low-priority alert categories
- Routing all alerts to email instead of a ticketing system
Correct answer: Tuning alert rules using baselines and suppressing known-good patterns
Baselining normal behavior and suppressing known-good events reduces noise while preserving detection of genuine anomalies.
Question 5: What does a 'golden signal' approach to monitoring measure in microservices?
- Code coverage percentage and static analysis scores
- Latency, traffic, errors, and saturation (Correct answer)
- Container image vulnerability counts
- Build pipeline success rates
Correct answer: Latency, traffic, errors, and saturation
Google's four golden signalsâlatency, traffic, errors, and saturationâprovide the minimal set of metrics needed to understand service health.
Question 6: During incident eradication, a team discovers a backdoor in a production Docker image. What is the correct remediation sequence?
- Patch the running container in place, then update the Dockerfile
- Rebuild the image from a clean base in the pipeline, redeploy, and invalidate all compromised image tags (Correct answer)
- Delete the running containers and trust the existing image registry
- Restore from the last known-good snapshot without rebuilding
Correct answer: Rebuild the image from a clean base in the pipeline, redeploy, and invalidate all compromised image tags
Backdoored images must be rebuilt from clean sources through the trusted pipeline; patching in place leaves the supply chain compromised.
Question 7: Which log source is most critical for detecting privilege escalation attacks within a Kubernetes cluster?
- Application error logs
- Kubernetes API server audit logs (Correct answer)
- Container stdout/stderr streams
- Node OS kernel logs
Correct answer: Kubernetes API server audit logs
Kubernetes API server audit logs record every API call including RBAC-sensitive operations like binding roles or accessing secrets, making privilege escalation visible.
CDP Continuous Monitoring & Incident Response 3
Which artifact should be preserved FIRST when performing forensic analysis after a container compromise?