What is the primary purpose of a container orchestration platform?

To provide a runtime for executing individual containers on a single host

To build container images from source code and push them to a registry

To secure the host operating system against container escape attacks

To automate the deployment, scaling, and management of containerized applications

A platform team is managing a Kubernetes cluster that runs a mix of stateless and stateful workloads. They are planning a cluster upgrade that will require restarting all nodes. The team wants to ensure that the stateful workloads experience minimal downtime and that data is not corrupted. Which strategy should they use?

Drain and upgrade nodes one at a time, using PodDisruptionBudgets (PDBs) to control the number of unavailable pods for stateful workloads.

Use a rolling update strategy on the node pools, but do not set any PDBs for stateful workloads.

Manually back up all persistent volumes before the upgrade and restore them after the upgrade.

Upgrade all nodes simultaneously to minimize the total maintenance window.

A security team is hardening a Kubernetes cluster that runs untrusted workloads. They want to ensure that a compromised container cannot access the host's kernel or other containers on the same node. Which combination of security measures should they implement?

Set the pod security context to privileged and use a NetworkPolicy to restrict traffic.

Apply a PodSecurityPolicy (or Pod Security Admission) that requires runAsNonRoot and readOnlyRootFilesystem.

Use a Service Mesh with mTLS and enable audit logging on the API server.

Use a container runtime with a sandboxing feature (e.g., gVisor or Kata Containers) and apply a Seccomp profile to all pods.

A platform team is designing a Kubernetes cluster for a critical application that must remain available during node maintenance. The application is stateless and can tolerate pod restarts. They have a limited budget and cannot afford to run extra idle nodes. Which strategy best meets their requirements?

Use a Deployment with multiple replicas and a PodDisruptionBudget that requires at least one replica to be available.

Use a StatefulSet with persistent volumes and a PodDisruptionBudget.

Use a DaemonSet to run the application on every node.

Use a single replica Deployment and rely on the cluster's self-healing to restart the pod.

Which Kubernetes resource is used to specify the minimum and maximum amount of CPU or memory a container can use?

requests and limits fields in a container spec

GIAC Cloud Security Automation

Domain 3Objective 1

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 1)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 1–5

1foundation · easy
What is the primary purpose of a container orchestration platform?
Select an answer first
2expert · hard
A platform team is managing a Kubernetes cluster that runs a mix of stateless and stateful workloads. They are planning a cluster upgrade that will require restarting all nodes. The team wants to ensure that the stateful workloads experience minimal downtime and that data is not corrupted. Which strategy should they use?
Select an answer first
3expert · hard
A security team is hardening a Kubernetes cluster that runs untrusted workloads. They want to ensure that a compromised container cannot access the host's kernel or other containers on the same node. Which combination of security measures should they implement?
Select an answer first
4expert · hard
A platform team is designing a Kubernetes cluster for a critical application that must remain available during node maintenance. The application is stateless and can tolerate pod restarts. They have a limited budget and cannot afford to run extra idle nodes. Which strategy best meets their requirements?
Select an answer first
5foundation · easy
Which Kubernetes resource is used to specify the minimum and maximum amount of CPU or memory a container can use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 1)

Questions 1–5

What is the primary purpose of a container orchestration platform?

A security team is hardening a Kubernetes cluster that runs untrusted workloads. They want to ensure that a compromised container cannot access the host's kernel or other containers on the same node. Which combination of security measures should they implement?

Which Kubernetes resource is used to specify the minimum and maximum amount of CPU or memory a container can use?

Keep studying — Container Orchestration Architecture and Security