A company's CI/CD pipeline uses a third-party action from a public marketplace to perform a build step. The action is widely used and has a good reputation. The security team is concerned about supply chain attacks. Which control provides the most effective mitigation against a compromised third-party action?

Rely on the action's popularity and reputation to ensure it is safe.

Pin the action to a specific commit hash and review the source code of that commit before using it.

Use a fork of the action that is maintained by the company's own security team.

Use the latest version of the action to ensure all security patches are applied.

An organization uses Infrastructure as Code (IaC) to provision cloud resources. The security team wants to ensure that all IaC changes are reviewed and that non-compliant configurations are not deployed. Which approach should be implemented?

Use a version control system to track changes and rely on peer review.

Integrate policy-as-code scanning into the CI/CD pipeline and require manual approval for changes that violate policies.

Conduct periodic manual reviews of IaC templates.

Use a configuration management tool to enforce policies at runtime.

Why is logging an essential part of CI/CD compliance and auditing?

It automatically fixes security issues

It eliminates the need for access controls

It provides a record of actions for accountability and incident investigation

It helps to speed up the pipeline execution

A company is migrating its CI/CD pipeline to a new cloud provider. The security team wants to ensure that the pipeline is isolated from other tenants and that all pipeline data is encrypted. The company also needs to comply with data residency requirements. Which configuration should be used?

Use a private cloud with dedicated physical hardware and no encryption.

Use a shared public cloud environment with encryption at rest only.

Use a dedicated virtual private cloud (VPC) with encryption at rest and in transit, and select a region that meets data residency requirements.

Use a hybrid cloud with on-premises storage for all pipeline data.

In a typical CI/CD pipeline, what is the main purpose of the 'build' stage?

To compile the source code and produce deployable artifacts

To deploy the application to a production server

To gather requirements from stakeholders

To run security tests against the production environment

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 8)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 36–40

36expert · hard
A company's CI/CD pipeline uses a third-party action from a public marketplace to perform a build step. The action is widely used and has a good reputation. The security team is concerned about supply chain attacks. Which control provides the most effective mitigation against a compromised third-party action?
Select an answer first
37application · medium
An organization uses Infrastructure as Code (IaC) to provision cloud resources. The security team wants to ensure that all IaC changes are reviewed and that non-compliant configurations are not deployed. Which approach should be implemented?
Select an answer first
38foundation · easy
Why is logging an essential part of CI/CD compliance and auditing?
Select an answer first
39expert · hard
A company is migrating its CI/CD pipeline to a new cloud provider. The security team wants to ensure that the pipeline is isolated from other tenants and that all pipeline data is encrypted. The company also needs to comply with data residency requirements. Which configuration should be used?
Select an answer first
40foundation · easy
In a typical CI/CD pipeline, what is the main purpose of the 'build' stage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.