A cluster runs a critical application that must remain available during a node failure. The application is deployed as a single pod with no ReplicaSet. The administrator wants to ensure the pod is automatically rescheduled if its node fails. Which approach should be used?

Create a Service with `externalTrafficPolicy: Local`

Set `restartPolicy: Always` on the pod

Wrap the pod in a Deployment with `replicas: 1`

Use a StatefulSet with `replicas: 1`

A Kubernetes cluster has a control plane that is not highly available. The team wants to minimize downtime during maintenance. They plan to update the control plane components. What is the best approach to ensure cluster availability during the update?

Update the kubelets on all nodes first

Stop the control plane and update all components at once

Use a maintenance window and accept downtime

Deploy multiple replicas of the control plane components and update them one at a time

A company runs a stateful database on Kubernetes. They need the database data to survive pod restarts and be accessible across node failures. They also need to ensure that only one pod can write to the database at a time. Which combination of Kubernetes features should they use?

A Deployment with a PersistentVolumeClaim

A ReplicaSet with an emptyDir volume

A StatefulSet with a PersistentVolumeClaim

A DaemonSet with a hostPath volume

A pod contains two containers: a web server and a sidecar that reads the web server's access logs. The sidecar needs to read the log files as they are written. Which approach ensures the sidecar can access the logs?

Use localhost networking so the sidecar can connect to the web server's port

Have the sidecar use `kubectl exec` to read the web server's filesystem

Share a volume between the two containers and have the web server write logs to that volume

Place the containers in the same namespace and use a Service to expose the logs

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 3)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 11–15

11expert · hard
A cluster runs a critical application that must remain available during a node failure. The application is deployed as a single pod with no ReplicaSet. The administrator wants to ensure the pod is automatically rescheduled if its node fails. Which approach should be used?
Select an answer first
12expert · hard
A Kubernetes cluster has a control plane that is not highly available. The team wants to minimize downtime during maintenance. They plan to update the control plane components. What is the best approach to ensure cluster availability during the update?
Select an answer first
13application · medium
A Kubernetes cluster has multiple nodes with different resource capacities. The scheduler needs to place pods efficiently, considering CPU and memory requests. Which component is responsible for making the initial placement decision for a new pod?
Select an answer first
14application · medium
A company runs a stateful database on Kubernetes. They need the database data to survive pod restarts and be accessible across node failures. They also need to ensure that only one pod can write to the database at a time. Which combination of Kubernetes features should they use?
Select an answer first
15application · medium
A pod contains two containers: a web server and a sidecar that reads the web server's access logs. The sidecar needs to read the log files as they are written. Which approach ensures the sidecar can access the logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.