What is 'drift detection' in the context of IaC security?

The process of automatically fixing all configuration errors

The process of updating the IaC templates to match the current environment

The process of deleting unused resources

The process of identifying when the actual cloud environment differs from the desired state defined in IaC

A security analyst is investigating a potential attack on a CI/CD pipeline. The analyst notices that a malicious script was executed during the build process, and the script exfiltrated environment variables containing secrets. Which vulnerability is most likely being exploited?

Code injection in the pipeline script.

Supply chain attack on a dependency.

A development team is implementing a CI/CD pipeline for a microservices application. The team wants to ensure that each microservice is built, tested, and deployed independently. Which pipeline design should be used?

Use a pipeline that only builds and tests, with manual deployment.

Use a single pipeline that builds and deploys all microservices together.

Use a pipeline that deploys to production directly from the code commit.

Create a separate pipeline for each microservice with its own build, test, and deploy stages.

A company's CI/CD pipeline builds a container image and pushes it to a registry. The security team wants to ensure that the image does not run as root in production and that it has a minimal attack surface. What should the pipeline do?

Use a multi-stage build that copies only the necessary artifacts to a minimal runtime image, and configure the container to run as a non-root user.

Use a large base image with all necessary tools pre-installed to avoid build failures.

Run a vulnerability scan on the image and fail the pipeline if any vulnerabilities are found.

Use the base image as-is and add a non-root user in the Dockerfile.

A company's CI/CD pipeline builds a Java application using Maven. The pipeline downloads dependencies from a public repository. The security team is concerned about a dependency confusion attack, where a malicious package with the same name as an internal package is published to the public repository. What is the most effective mitigation?

Configure the build tool to use a private package repository as the primary source and only fall back to the public repository for packages not found internally.

Use a public repository mirror that is updated daily to ensure the latest versions are available.

Pin all dependencies to their exact versions in the build file.

Run a vulnerability scanner on the final application to detect known vulnerabilities in the dependencies.

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 1)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 1–5

1foundation · easy
What is 'drift detection' in the context of IaC security?
Select an answer first
2application · medium
A security analyst is investigating a potential attack on a CI/CD pipeline. The analyst notices that a malicious script was executed during the build process, and the script exfiltrated environment variables containing secrets. Which vulnerability is most likely being exploited?
Select an answer first
3application · medium
A development team is implementing a CI/CD pipeline for a microservices application. The team wants to ensure that each microservice is built, tested, and deployed independently. Which pipeline design should be used?
Select an answer first
4application · medium
A company's CI/CD pipeline builds a container image and pushes it to a registry. The security team wants to ensure that the image does not run as root in production and that it has a minimal attack surface. What should the pipeline do?
Select an answer first
5application · medium
A company's CI/CD pipeline builds a Java application using Maven. The pipeline downloads dependencies from a public repository. The security team is concerned about a dependency confusion attack, where a malicious package with the same name as an internal package is published to the public repository. What is the most effective mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.