A Kubernetes cluster has a Deployment with `replicas: 3`. During a rolling update, the new ReplicaSet fails to become ready. The Deployment's `progressDeadlineSeconds` is set to 600. What will happen?

The old ReplicaSet will be scaled down to zero immediately

The Deployment will automatically roll back to the previous ReplicaSet

The Deployment will continue to retry indefinitely

The Deployment will be marked as failed, and the rollout will be paused automatically

A security team is hardening a container image. They want to ensure that the container does not run with root privileges and that it cannot write to the host filesystem. Which set of configurations should they apply?

Run as a non-root user and use a read-only root filesystem

Run as root and use a read-only root filesystem

Run as root and use a writable root filesystem

Run as non-root and mount a hostPath volume

A cluster has a node with a taint `dedicated=monitoring:NoSchedule`. A pod that runs a monitoring agent must be scheduled on this node. The pod spec currently has no tolerations. Which change is required?

Add a nodeSelector to the pod spec with `dedicated: monitoring`

Add a toleration to the pod spec for `dedicated=monitoring:NoSchedule`

Set the pod's priorityClass to high

A pod in a Kubernetes cluster needs to access an external API that requires a specific source IP allowlist. The cluster uses SNAT for outbound traffic. The administrator wants to ensure the pod's traffic egresses with a consistent IP. Which approach should be used?

Use a NAT gateway or egress IP feature provided by the cloud provider

Set the pod's `hostNetwork: true`

Use a Service with `externalTrafficPolicy: Cluster`

Create a NetworkPolicy that allows egress to the API

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 8)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 36–40

36expert · hard
A Kubernetes cluster has a Deployment with `replicas: 3`. During a rolling update, the new ReplicaSet fails to become ready. The Deployment's `progressDeadlineSeconds` is set to 600. What will happen?
Select an answer first
37expert · hard
A security team is hardening a container image. They want to ensure that the container does not run with root privileges and that it cannot write to the host filesystem. Which set of configurations should they apply?
Select an answer first
38expert · medium
A cluster has a node with a taint `dedicated=monitoring:NoSchedule`. A pod that runs a monitoring agent must be scheduled on this node. The pod spec currently has no tolerations. Which change is required?
Select an answer first
39expert · hard
A pod in a Kubernetes cluster needs to access an external API that requires a specific source IP allowlist. The cluster uses SNAT for outbound traffic. The administrator wants to ensure the pod's traffic egresses with a consistent IP. Which approach should be used?
Select an answer first
40application · medium
A Kubernetes cluster is being set up for a production environment. The team needs to ensure that the control plane is highly available and that node failures do not affect the cluster's ability to manage pods. Which component should be replicated across multiple machines?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.