What is the primary function of a Kubernetes Service?

To store configuration data that can be mounted into pods.

To provide a stable network endpoint for a set of pods.

To manage the lifecycle of pods, including scaling and updates.

To provide persistent storage for stateful applications.

A security team is investigating a compromised container in a Kubernetes cluster. They need to identify which files were added or modified by the attacker after the container started. The container image was built from a base image and includes several layers. Which approach would best help the team isolate the attacker's changes?

Use `kubectl logs` to review the container's stdout and stderr output

Check the pod's service account and role bindings for unauthorized permissions

Inspect the container's image history to see which layers were added during the build

Compare the container's writable layer against the image's lower layers using `docker diff` or `ctr diff`

A container image is built with a base image that contains a vulnerable library. The team wants to reduce the attack surface without changing the application code. Which approach is most effective?

Run the container with `--read-only` root filesystem

Rebuild the image using a multi-stage build that copies only the compiled binary into a minimal runtime image

Set the container's user to non-root

Use a container runtime that supports seccomp profiles

A security team is investigating a container escape. The container was running with `--privileged` and had the host's PID namespace mounted. The team wants to understand how the attacker could have accessed host processes. Which container runtime feature directly enabled this?

The container shared the host's PID namespace, allowing the attacker to see and interact with host processes

The container used a bridge network, giving it access to the host's network stack

The container had a volume mounted from the host, allowing it to read host files

The container had a writable layer, allowing the attacker to modify the image

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 1)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 1–5

1foundation · easy
What is the primary function of a Kubernetes Service?
Select an answer first
2application · medium
A security team is investigating a compromised container in a Kubernetes cluster. They need to identify which files were added or modified by the attacker after the container started. The container image was built from a base image and includes several layers. Which approach would best help the team isolate the attacker's changes?
Select an answer first
3expert · hard
A container image is built with a base image that contains a vulnerable library. The team wants to reduce the attack surface without changing the application code. Which approach is most effective?
Select an answer first
4foundation · easy
Which Kubernetes component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of pod replicas are running?
Select an answer first
5expert · hard
A security team is investigating a container escape. The container was running with `--privileged` and had the host's PID namespace mounted. The team wants to understand how the attacker could have accessed host processes. Which container runtime feature directly enabled this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.