A security team is investigating a breach where an attacker was able to modify the CI/CD pipeline configuration and inject malicious code into the build process. The attacker used a compromised developer account. Which combination of controls would have most effectively prevented this attack?

Multi-factor authentication for all pipeline administrators and code review for pipeline configuration changes.

Encryption of data at rest and in transit.

Network segmentation and a web application firewall.

Regular backups and incident response procedures.

A developer accidentally commits a database password to a public GitHub repository. The password is used by the CI/CD pipeline to connect to the production database. What is the most immediate and critical action the team should take?

Add a comment to the commit noting that the password is no longer valid.

Change the repository from public to private.

Rotate the database password immediately and revoke the compromised credential.

Delete the commit from the repository and force-push the previous commit.

What is the purpose of scanning dependencies for known vulnerabilities in a software supply chain?

To verify that the application meets performance benchmarks

To ensure the application compiles without errors

To check for licensing compliance only

To identify and remediate known security issues in third-party libraries

A company is deploying a containerized application to a Kubernetes cluster. The security team wants to ensure that containers do not run with unnecessary privileges. Which configuration should be applied?

Disable security policies to avoid configuration issues.

Set the container's security context to run as a non-root user and drop all capabilities.

Run containers as root to ensure compatibility with the application.

Use a privileged container to allow access to host resources.

A company's CI/CD pipeline deploys a critical application to production. The pipeline is triggered by commits to the main branch. A security review identifies that the pipeline uses a single, highly privileged service account for all stages, and that any developer with write access to the repository can modify the pipeline definition. The team wants to reduce the risk of a malicious pipeline change without significantly slowing down the development process. Which approach best balances security and developer velocity?

Require a second reviewer to approve all changes to the pipeline definition, and use a separate, least-privilege service account for the production deployment stage.

Allow any developer to modify the pipeline, but enable a post-deployment audit log that records all changes.

Automate the pipeline to run without any manual approvals, but use a static analysis tool to scan the pipeline definition for security issues.

Use the same service account for all stages to simplify management, but restrict write access to the repository to a small group of senior developers.

GIAC Cloud Penetration Tester

Domain 5Objective 1

Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 9)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 41–45

41expert · hard
A security team is investigating a breach where an attacker was able to modify the CI/CD pipeline configuration and inject malicious code into the build process. The attacker used a compromised developer account. Which combination of controls would have most effectively prevented this attack?
Select an answer first
42application · medium
A developer accidentally commits a database password to a public GitHub repository. The password is used by the CI/CD pipeline to connect to the production database. What is the most immediate and critical action the team should take?
Select an answer first
43foundation · easy
What is the purpose of scanning dependencies for known vulnerabilities in a software supply chain?
Select an answer first
44application · medium
A company is deploying a containerized application to a Kubernetes cluster. The security team wants to ensure that containers do not run with unnecessary privileges. Which configuration should be applied?
Select an answer first
45expert · hard
A company's CI/CD pipeline deploys a critical application to production. The pipeline is triggered by commits to the main branch. A security review identifies that the pipeline uses a single, highly privileged service account for all stages, and that any developer with write access to the repository can modify the pipeline definition. The team wants to reduce the risk of a malicious pipeline change without significantly slowing down the development process. Which approach best balances security and developer velocity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.