A company stores sensitive data in an object storage bucket. They want to ensure that only a specific application (running on a VM) can access the bucket, and that the data is encrypted in transit and at rest. Which combination of controls should they implement?

Use a pre-signed URL that expires in 10 years.

Make the bucket public and rely on the application's authentication.

Use a VPC endpoint for the bucket, attach an IAM role to the VM, and enable server-side encryption.

Use a bucket policy that allows access only from the VM's public IP address, and enable HTTPS.

A security engineer is reviewing a Kubernetes cluster that runs untrusted container workloads. The engineer wants to reduce the risk of container breakout and limit the impact of a compromised container. Which configuration is most effective?

Use a pod security policy that disallows privileged containers and enforces a read-only root filesystem.

Use a service mesh to encrypt traffic between pods.

Enable audit logging on the cluster.

Run containers in a separate namespace with network policies.

A company runs a data analytics workload that reads large datasets from a cloud storage bucket. The workload is I/O intensive but only runs for a few hours each night. The storage team wants to minimize costs without sacrificing performance during the job. Which storage configuration is most appropriate?

Use a cold storage tier for all data to reduce cost.

Use a standard storage tier with a lifecycle rule to move data to a cold tier after the job completes.

Use a file storage share with a high-performance tier.

Use a provisioned IOPS block storage volume mounted to the analytics server.

What is the primary role of a container orchestration platform like Kubernetes?

To automate the deployment, scaling, and management of containerized applications.

To secure the host operating system by patching kernel vulnerabilities.

To provide a graphical interface for editing container images.

To replace the need for a container runtime such as Docker or containerd.

GIAC Cloud Security Essentials

Domain 4Objective 2

Containers and Cloud Storage GCLD Practice Questions (Page 2)

Part of the Compute, Storage, and Containers domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 6–10

6foundation · easy
Which storage tier is typically the most cost-effective for infrequently accessed data that must be retained for long periods?
Select an answer first
7expert · hard
A company stores sensitive data in an object storage bucket. They want to ensure that only a specific application (running on a VM) can access the bucket, and that the data is encrypted in transit and at rest. Which combination of controls should they implement?
Select an answer first
8application · medium
A security engineer is reviewing a Kubernetes cluster that runs untrusted container workloads. The engineer wants to reduce the risk of container breakout and limit the impact of a compromised container. Which configuration is most effective?
Select an answer first
9application · medium
A company runs a data analytics workload that reads large datasets from a cloud storage bucket. The workload is I/O intensive but only runs for a few hours each night. The storage team wants to minimize costs without sacrificing performance during the job. Which storage configuration is most appropriate?
Select an answer first
10foundation · easy
What is the primary role of a container orchestration platform like Kubernetes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Containers and Cloud Storage GCLD Practice Questions (Page 2)

Questions 6–10

Which storage tier is typically the most cost-effective for infrequently accessed data that must be retained for long periods?

A company stores sensitive data in an object storage bucket. They want to ensure that only a specific application (running on a VM) can access the bucket, and that the data is encrypted in transit and at rest. Which combination of controls should they implement?

A security engineer is reviewing a Kubernetes cluster that runs untrusted container workloads. The engineer wants to reduce the risk of container breakout and limit the impact of a compromised container. Which configuration is most effective?

What is the primary role of a container orchestration platform like Kubernetes?

Keep studying — Compute, Storage, and Containers