A DevOps team is using a secrets management service to store secrets for its CI/CD pipeline. The team wants to ensure that secrets are rotated regularly and that access to secrets is audited. Which configuration should be implemented?

Use a single secret for all environments and rotate manually.

Store secrets in a shared team vault with no rotation.

Use static secrets and rely on the CI/CD platform's logging.

Enable automatic secret rotation and audit logging for all secret access.

Which of the following is a container hardening practice that can be applied during the image build process?

Running the container as the root user for maximum permissions

Disabling all security features to improve performance

Including all possible debugging tools in the image

Using a minimal base image and removing unnecessary packages

What is the purpose of monitoring CI/CD pipelines for compliance?

To reduce the cost of cloud resources

To ensure that all pipeline activities are performed according to defined policies and regulations

To automatically approve all code changes

To increase the number of deployments per day

A company uses Infrastructure as Code (IaC) to provision cloud resources. The security team wants to enforce that all S3 buckets are private by default and that any attempt to create a public bucket is blocked before the resource is deployed. What is the most effective control to implement?

Add a policy-as-code check in the CI/CD pipeline that scans the IaC templates and fails the build if a public bucket is detected.

Run a post-deployment script that identifies public buckets and changes their ACLs to private.

Configure a cloud provider alert that notifies the security team when a public bucket is created.

Require developers to manually review their IaC templates before merging to the main branch.

What is the purpose of signing container images in a CI/CD pipeline?

To compress the image for faster download

To automatically fix vulnerabilities in the image

To verify the image's origin and integrity

To make the image compatible with all container runtimes

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 4)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 16–20

16expert · hard
A DevOps team is using a secrets management service to store secrets for its CI/CD pipeline. The team wants to ensure that secrets are rotated regularly and that access to secrets is audited. Which configuration should be implemented?
Select an answer first
17foundation · easy
Which of the following is a container hardening practice that can be applied during the image build process?
Select an answer first
18foundation · easy
What is the purpose of monitoring CI/CD pipelines for compliance?
Select an answer first
19application · medium
A company uses Infrastructure as Code (IaC) to provision cloud resources. The security team wants to enforce that all S3 buckets are private by default and that any attempt to create a public bucket is blocked before the resource is deployed. What is the most effective control to implement?
Select an answer first
20foundation · easy
What is the purpose of signing container images in a CI/CD pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.