A financial services company must ensure that its CI/CD pipeline meets regulatory compliance requirements. The compliance team needs to demonstrate that all changes are traceable and that the pipeline is auditable. Which practice should be implemented?

Enable detailed logging of all pipeline activities and store logs in an immutable, centralized location.

Use a version control system and require code reviews.

Conduct quarterly security assessments of the pipeline.

Restrict access to the pipeline to a small group of administrators.

A company is migrating a monolithic application to a cloud native architecture. The team plans to break the application into multiple microservices, each deployed as a container. They need to choose an orchestration platform that provides automated scaling, service discovery, and self-healing. Which platform best fits these requirements?

A platform-as-a-service (PaaS) offering that deploys the application as a single unit.

A managed Kubernetes service that provides automated scaling, service discovery, and self-healing capabilities for containerized microservices.

A serverless function platform that runs individual functions in response to events.

A virtual machine scale set that automatically adjusts the number of VMs based on load.

Which of the following is a common security risk in CI/CD pipelines?

Automating builds with a CI server

Running tests in a staging environment

Hardcoded secrets in pipeline configuration files

Using version control for pipeline definitions

A cloud team is using Terraform to manage infrastructure. The team wants to ensure that any manual changes to the infrastructure are detected and that the IaC code is the source of truth. Which practice should be implemented?

Use `terraform import` to bring existing resources under management.

Use `terraform state` commands to manually update the state file.

Run `terraform plan` and `terraform apply` in the CI/CD pipeline and use `terraform plan` to detect drift.

Use `terraform destroy` and recreate resources to ensure consistency.

A software company uses open-source libraries in its applications. The security team wants to reduce the risk of using vulnerable or malicious dependencies. Which practice should be implemented in the CI/CD pipeline?

Using only the latest versions of dependencies without scanning.

Restricting the use of open-source libraries altogether.

Manual review of all dependencies before each release.

Automated dependency scanning and license compliance checks.

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 3)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 11–15

11application · medium
A financial services company must ensure that its CI/CD pipeline meets regulatory compliance requirements. The compliance team needs to demonstrate that all changes are traceable and that the pipeline is auditable. Which practice should be implemented?
Select an answer first
12application · medium
A company is migrating a monolithic application to a cloud native architecture. The team plans to break the application into multiple microservices, each deployed as a container. They need to choose an orchestration platform that provides automated scaling, service discovery, and self-healing. Which platform best fits these requirements?
Select an answer first
13foundation · easy
Which of the following is a common security risk in CI/CD pipelines?
Select an answer first
14expert · hard
A cloud team is using Terraform to manage infrastructure. The team wants to ensure that any manual changes to the infrastructure are detected and that the IaC code is the source of truth. Which practice should be implemented?
Select an answer first
15application · medium
A software company uses open-source libraries in its applications. The security team wants to reduce the risk of using vulnerable or malicious dependencies. Which practice should be implemented in the CI/CD pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.