What is the purpose of a PersistentVolumeClaim (PVC) in Kubernetes?

To define the storage class for a cluster.

To provide a stable IP address for a stateful application.

To request storage resources from a PersistentVolume.

To encrypt data at rest in a persistent volume.

What is the difference between a Kubernetes Volume and a PersistentVolume?

A Volume is only accessible by one container, while a PersistentVolume can be shared by multiple containers.

A Volume is stored on the node's local disk, while a PersistentVolume is stored in the cloud.

A Volume is used for temporary storage, while a PersistentVolume is used for long-term storage.

A Volume has the same lifecycle as the pod, while a PersistentVolume has a lifecycle independent of any pod.

A pod in a Kubernetes cluster needs to communicate with a database running on a VM outside the cluster. The database's IP address is static. Which approach should be used to allow the pod to reach the database?

Create a headless Service with a selector matching the database pod

Use the pod's /etc/hosts file to map the database hostname to its IP

Create a NetworkPolicy allowing egress to the database's IP

Create a Kubernetes Service of type ExternalName that points to the database's DNS name

What is the primary purpose of the container runtime in a containerized environment?

To manage the network overlay and load balancing between containers on different hosts.

To execute containers by using the host kernel to create isolated namespaces and apply resource limits.

To build container images from a Dockerfile and push them to a registry.

To provide a user interface for managing containers and viewing logs.

An administrator notices that a Kubernetes Deployment's pods are not being scheduled. The cluster has three worker nodes, all with sufficient CPU and memory. `kubectl describe pod` shows the event: '0/3 nodes are available: 3 node(s) had taint {dedicated: prod}, that the pod didn't tolerate.' The Deployment's namespace is 'dev'. What is the most likely cause?

The pod's service account lacks permission to schedule on those nodes

The nodes are tainted to repel pods that do not have a matching toleration, and the pod lacks the required toleration

The Deployment's replica count exceeds the cluster's node capacity

The namespace 'dev' has a ResourceQuota that prevents pod creation

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 6)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 26–30

26foundation · easy
What is the purpose of a PersistentVolumeClaim (PVC) in Kubernetes?
Select an answer first
27foundation · easy
What is the difference between a Kubernetes Volume and a PersistentVolume?
Select an answer first
28application · medium
A pod in a Kubernetes cluster needs to communicate with a database running on a VM outside the cluster. The database's IP address is static. Which approach should be used to allow the pod to reach the database?
Select an answer first
29foundation · easy
What is the primary purpose of the container runtime in a containerized environment?
Select an answer first
30application · medium
An administrator notices that a Kubernetes Deployment's pods are not being scheduled. The cluster has three worker nodes, all with sufficient CPU and memory. `kubectl describe pod` shows the event: '0/3 nodes are available: 3 node(s) had taint {dedicated: prod}, that the pod didn't tolerate.' The Deployment's namespace is 'dev'. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.