Which practice is a key security consideration for container images?

Storing images only in public repositories to increase transparency.

Disabling all logging inside containers to reduce attack surface.

Scanning images for known vulnerabilities before deployment.

Running containers with root privileges to simplify permission management.

Which statement best describes how containers differ from virtual machines (VMs) in a cloud environment?

Containers require a hypervisor to run, while VMs run directly on the host hardware.

Containers share the host operating system kernel, while VMs each run a full guest operating system on a hypervisor.

Containers provide the same level of isolation as VMs because both use hardware virtualization.

Containers are larger in size than VMs because they include a full operating system.

What is the purpose of storage lifecycle management policies?

To create snapshots of storage volumes for disaster recovery.

To provide real-time analytics on storage access patterns.

To encrypt data using a customer-managed key.

To automatically transition data to lower-cost storage tiers or delete it after a specified period.

An organization runs a stateful application in containers on Kubernetes. The application requires persistent storage that can be accessed by multiple pods simultaneously. The team must choose a storage solution that supports ReadWriteMany (RWX) access mode and provides encryption at rest. Which solution should they choose?

Use an in-memory cache (e.g., Redis) for shared state.

Use a local ephemeral volume on each node.

Use a cloud file storage service (e.g., Azure Files) with a persistent volume claim that requests RWX.

Use a cloud block storage service (e.g., Azure Disk) with a persistent volume claim that requests RWX.

A company stores 500 TB of archival data that is accessed less than once per year. The data must be retained for 10 years. The current storage cost is too high, and the company is willing to accept retrieval times of up to 12 hours. Which storage solution is most cost-effective?

Keep the data in a standard storage tier and rely on infrequent access.

Use a block storage volume with snapshots.

Store the data on a tape backup system on-premises.

Move the data to a cold/archive storage tier with a lifecycle policy.

GIAC Cloud Security Essentials

Domain 4Objective 2

Containers and Cloud Storage GCLD Practice Questions (Page 5)

Part of the Compute, Storage, and Containers domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 21–25

21foundation · easy
Which practice is a key security consideration for container images?
Select an answer first
22foundation · easy
Which statement best describes how containers differ from virtual machines (VMs) in a cloud environment?
Select an answer first
23foundation · easy
What is the purpose of storage lifecycle management policies?
Select an answer first
24expert · hard
An organization runs a stateful application in containers on Kubernetes. The application requires persistent storage that can be accessed by multiple pods simultaneously. The team must choose a storage solution that supports ReadWriteMany (RWX) access mode and provides encryption at rest. Which solution should they choose?
Select an answer first
25expert · hard
A company stores 500 TB of archival data that is accessed less than once per year. The data must be retained for 10 years. The current storage cost is too high, and the company is willing to accept retrieval times of up to 12 hours. Which storage solution is most cost-effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.