A container image is built with multiple layers. During a security review, the team wants to reduce the attack surface by minimizing the number of layers and removing unnecessary tools. Which practice directly achieves this?

Run the container with a read-only root filesystem

Use a smaller base image like Alpine

Use a multi-stage build to copy only the necessary artifacts into the final image

A cluster administrator wants to ensure that a specific set of pods are always scheduled on nodes that have SSD storage. The nodes are labeled with `disktype=ssd`. Which configuration should be used?

Add a nodeSelector to the pod spec with `disktype: ssd`

Create a Service that routes traffic only to SSD nodes

Use a taint on non-SSD nodes and a toleration on the pods

Set the pod's priorityClass to high so it gets scheduled on SSD nodes

A pod in a Kubernetes cluster needs to be reachable from other pods using a stable DNS name, even if the pod's IP address changes. Which Kubernetes object should be used?

A NetworkPolicy allowing ingress to the pod

A ClusterIP Service with a selector matching the pod's labels

A headless Service with a selector

A ConfigMap with the pod's IP address

A team is running a stateful application on Kubernetes and needs to ensure that data persists across pod restarts. They also need to be able to dynamically provision storage based on the application's requirements. Which approach should they use?

Use a PersistentVolumeClaim with a StorageClass

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 10)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 46–49

46application · medium
A container image is built with multiple layers. During a security review, the team wants to reduce the attack surface by minimizing the number of layers and removing unnecessary tools. Which practice directly achieves this?
Select an answer first
47application · easy
A cluster administrator wants to ensure that a specific set of pods are always scheduled on nodes that have SSD storage. The nodes are labeled with `disktype=ssd`. Which configuration should be used?
Select an answer first
48application · medium
A pod in a Kubernetes cluster needs to be reachable from other pods using a stable DNS name, even if the pod's IP address changes. Which Kubernetes object should be used?
Select an answer first
49application · medium
A team is running a stateful application on Kubernetes and needs to ensure that data persists across pod restarts. They also need to be able to dynamically provision storage based on the application's requirements. Which approach should they use?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.