A Kubernetes cluster uses a CNI plugin that does not support NetworkPolicies. The security team wants to restrict traffic between pods in different namespaces. What is the most effective way to achieve this?

Use RBAC to restrict pod communication

Use separate clusters for each namespace

Use a CNI plugin that supports NetworkPolicies

Use Kubernetes Services to control traffic

A security team is reviewing a Kubernetes cluster where an application consists of a web frontend and a backend cache. They need the frontend to communicate with the cache using localhost to avoid network overhead. What is the most appropriate way to achieve this?

Place both containers in the same pod

Create a Service that exposes the cache on a cluster IP

Configure the frontend to use the cache's pod IP directly

Use a headless Service to get the cache pod IP

A Kubernetes cluster has a mix of workloads: some require GPU resources, and others are CPU-intensive. The team wants to ensure that GPU workloads are only scheduled on nodes with GPUs. Which approach should they use?

Use a DaemonSet to run GPU workloads on all nodes

Use resource requests and limits for CPU and memory only

Use a Service to route traffic to GPU nodes

Use node labels and nodeSelector in the pod spec

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 7)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 31–35

31expert · hard
A Kubernetes cluster uses a CNI plugin that does not support NetworkPolicies. The security team wants to restrict traffic between pods in different namespaces. What is the most effective way to achieve this?
Select an answer first
32application · medium
A security team is reviewing a Kubernetes cluster where an application consists of a web frontend and a backend cache. They need the frontend to communicate with the cache using localhost to avoid network overhead. What is the most appropriate way to achieve this?
Select an answer first
33application · medium
A Kubernetes cluster has pods running on different nodes. A frontend pod needs to communicate with a backend pod that may be rescheduled to a different node. Which Kubernetes object provides a stable network endpoint for the backend?
Select an answer first
34application · medium
A DevOps team deploys a stateless web application to a Kubernetes cluster. They need to ensure that if a pod fails, the application is automatically rescheduled with the same configuration, and that rolling updates can be performed without downtime. Which Kubernetes object should they use to manage the application?
Select an answer first
35expert · hard
A Kubernetes cluster has a mix of workloads: some require GPU resources, and others are CPU-intensive. The team wants to ensure that GPU workloads are only scheduled on nodes with GPUs. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Containers and Kubernetes Structure GCPN Practice Questions (Page 7)

Questions 31–35

A Kubernetes cluster uses a CNI plugin that does not support NetworkPolicies. The security team wants to restrict traffic between pods in different namespaces. What is the most effective way to achieve this?

A security team is reviewing a Kubernetes cluster where an application consists of a web frontend and a backend cache. They need the frontend to communicate with the cache using localhost to avoid network overhead. What is the most appropriate way to achieve this?

A Kubernetes cluster has pods running on different nodes. A frontend pod needs to communicate with a backend pod that may be rescheduled to a different node. Which Kubernetes object provides a stable network endpoint for the backend?

A Kubernetes cluster has a mix of workloads: some require GPU resources, and others are CPU-intensive. The team wants to ensure that GPU workloads are only scheduled on nodes with GPUs. Which approach should they use?

Keep studying — Container and Kubernetes Security