A software vendor distributes a containerized application to customers. The vendor wants to ensure that customers can verify the authenticity and integrity of the images. The vendor also wants to protect against a compromised build environment. Which approach should be used?

Encrypt the container images and provide the decryption key to customers.

Use a checksum file published on the vendor's website.

Sign the container images with a private key and provide the public key to customers for verification.

Use a private registry and require customers to authenticate.

A cloud team is implementing a CI/CD pipeline for infrastructure changes. The team wants to ensure that only authorized personnel can deploy changes and that all changes are recorded. Which configuration should be used?

Implement role-based access control and enable audit logging for all pipeline actions.

Use a shared account for all deployments and rely on the version control history.

Allow all developers to deploy directly to production without review.

Use a single admin account for all pipeline configuration changes.

Which method is considered secure for storing secrets used in a CI/CD pipeline?

Storing them in a plain text file in the repository

Using a dedicated secrets management service like a vault

Sharing them via email to the development team

Embedding them in the pipeline script

What is the purpose of integrating container security scanning into a CI/CD pipeline?

To ensure the container runs on all operating systems

To automatically deploy the container to production

To optimize the container image for faster startup

To check the container image for known vulnerabilities and misconfigurations

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 11)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 51–54

51expert · hard
A software vendor distributes a containerized application to customers. The vendor wants to ensure that customers can verify the authenticity and integrity of the images. The vendor also wants to protect against a compromised build environment. Which approach should be used?
Select an answer first
52application · medium
A cloud team is implementing a CI/CD pipeline for infrastructure changes. The team wants to ensure that only authorized personnel can deploy changes and that all changes are recorded. Which configuration should be used?
Select an answer first
53foundation · easy
Which method is considered secure for storing secrets used in a CI/CD pipeline?
Select an answer first
54foundation · easy
What is the purpose of integrating container security scanning into a CI/CD pipeline?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.