A penetration tester is examining a container that runs with a read-only root filesystem. They want to write temporary files to a location that is writable. Which approach is correct?

Write to /tmp inside the container

Use a hostPath volume to write to the host filesystem

Change the container image to make the root filesystem writable

Mount an emptyDir volume at a writable path

A team is deploying a microservices application on Kubernetes. They need to ensure that each microservice can be scaled independently and that a failure in one service does not affect others. Which combination of Kubernetes objects should they use?

A StatefulSet with a headless Service

Multiple Deployments, each with its own Service

A single Deployment with multiple containers in one pod

A security analyst is investigating a container escape attempt. They need to understand the isolation boundaries between the container and the host. Which statement accurately describes container isolation?

Containers run their own kernel and are fully isolated from the host

Containers are isolated at the hardware level using virtualization

Containers share the host kernel but have isolated user-space processes

Containers have no isolation and are identical to host processes

A company runs a batch processing workload on Kubernetes. The workload must process a queue of jobs, and each job is independent and can run in parallel. The team wants to minimize resource waste while ensuring that all jobs are processed. Which Kubernetes object should they use?

A Deployment with multiple replicas

A Job with a parallelism parameter

A StatefulSet with a headless Service

GIAC Cloud Penetration Tester

Domain 4Objective 1

Containers and Kubernetes Structure GCPN Practice Questions (Page 9)

Part of the Container and Kubernetes Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

Questions 41–45

41expert · hard
A penetration tester is examining a container that runs with a read-only root filesystem. They want to write temporary files to a location that is writable. Which approach is correct?
Select an answer first
42expert · hard
A team is deploying a microservices application on Kubernetes. They need to ensure that each microservice can be scaled independently and that a failure in one service does not affect others. Which combination of Kubernetes objects should they use?
Select an answer first
43application · medium
A security analyst is investigating a container escape attempt. They need to understand the isolation boundaries between the container and the host. Which statement accurately describes container isolation?
Select an answer first
44expert · medium
A stateful application requires persistent storage that must be accessible from multiple pods running on different nodes simultaneously. The storage backend supports ReadWriteMany (RWX). Which PersistentVolume access mode should be used?
Select an answer first
45expert · hard
A company runs a batch processing workload on Kubernetes. The workload must process a queue of jobs, and each job is independent and can run in parallel. The team wants to minimize resource waste while ensuring that all jobs are processed. Which Kubernetes object should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.