A development team is setting up a CI/CD pipeline for a web application. The pipeline needs to access a database password and an API key. The team wants to avoid storing secrets in the repository. Which method should be used?

Encrypt the secrets and store them in the repository.

Use environment variables in the CI/CD platform's configuration.

Have developers provide secrets manually during each pipeline run.

Store secrets in a secrets management service and retrieve them during the pipeline run.

What is the primary role of a container orchestration platform in a cloud native environment?

To compile application source code into machine code

To provide a graphical interface for developers to write code

To store container images in a central repository

To manage the lifecycle of containers, including deployment, scaling, and networking

A company's CI/CD pipeline deploys a payment processing application. The compliance team requires that all pipeline activity, including code commits, build logs, and deployment approvals, be recorded and retained for a minimum of seven years. The pipeline currently stores logs in the CI/CD platform's built-in log viewer, which only retains logs for 30 days. What is the most effective way to meet the retention requirement?

Configure the pipeline to stream all logs and audit events to a centralized, immutable log storage service with a retention policy of seven years.

Manually export the logs to a local file server every 30 days.

Rely on the cloud provider's built-in activity logs, which are retained indefinitely.

Increase the CI/CD platform's log retention setting to seven years.

What type of attack involves an attacker injecting malicious code into a dependency used by the application?

Distributed denial of service (DDoS)

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 6)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 26–30

26foundation · easy
Which CI/CD stage is primarily responsible for validating that the application behaves as expected in an environment similar to production?
Select an answer first
27application · medium
A development team is setting up a CI/CD pipeline for a web application. The pipeline needs to access a database password and an API key. The team wants to avoid storing secrets in the repository. Which method should be used?
Select an answer first
28foundation · easy
What is the primary role of a container orchestration platform in a cloud native environment?
Select an answer first
29application · medium
A company's CI/CD pipeline deploys a payment processing application. The compliance team requires that all pipeline activity, including code commits, build logs, and deployment approvals, be recorded and retained for a minimum of seven years. The pipeline currently stores logs in the CI/CD platform's built-in log viewer, which only retains logs for 30 days. What is the most effective way to meet the retention requirement?
Select an answer first
30foundation · easy
What type of attack involves an attacker injecting malicious code into a dependency used by the application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 6)

Questions 26–30

Which CI/CD stage is primarily responsible for validating that the application behaves as expected in an environment similar to production?

A development team is setting up a CI/CD pipeline for a web application. The pipeline needs to access a database password and an API key. The team wants to avoid storing secrets in the repository. Which method should be used?

What is the primary role of a container orchestration platform in a cloud native environment?

What type of attack involves an attacker injecting malicious code into a dependency used by the application?

Keep studying — Application and CI/CD Security