A company is evaluating container orchestration platforms for a new project. They have a team with limited Kubernetes experience and need to deploy a simple web application that can scale based on HTTP traffic. They also want to minimize operational overhead. Which approach is most appropriate?

Build a self-managed Kubernetes cluster from scratch.

Use a container instance service that automatically scales.

Use a managed Kubernetes service with a HorizontalPodAutoscaler.

Use a platform-as-a-service that abstracts away containers.

A security team is deploying a Kubernetes cluster for a multi-tenant application platform. They need to ensure that a compromised workload on one node cannot access the Kubernetes API server using the node's credentials, and they also want to prevent workloads from being scheduled on the same node as sensitive control-plane components. Which two configurations should they implement?

Use a ServiceAccount for each workload and set resource limits on namespaces.

Enable PodSecurityPolicy and use network policies to isolate namespaces.

Enable AlwaysPullImages admission controller and use node affinity to pin workloads to worker nodes.

Enable NodeRestriction admission controller and taint the control-plane nodes with NoSchedule.

A security engineer is reviewing a Kubernetes cluster that runs untrusted workloads from multiple tenants. The cluster uses a single control plane and multiple worker nodes. The engineer needs to reduce the risk of a compromised workload accessing the Kubernetes API server or other workloads. Which combination of controls is most effective?

Disable the Kubernetes dashboard and use a read-only API server.

Enable RBAC with least-privilege ServiceAccounts, use NetworkPolicies to isolate tenants, and enable the NodeRestriction admission controller.

Use a single ServiceAccount for all workloads and rely on namespace quotas.

Use a separate cluster for each tenant and disable network policies.

GIAC Cloud Security Automation

Domain 3Objective 1

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 2)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 6–10

6application · medium
A company is evaluating container orchestration platforms for a new project. They have a team with limited Kubernetes experience and need to deploy a simple web application that can scale based on HTTP traffic. They also want to minimize operational overhead. Which approach is most appropriate?
Select an answer first
7application · medium
A security team is deploying a Kubernetes cluster for a multi-tenant application platform. They need to ensure that a compromised workload on one node cannot access the Kubernetes API server using the node's credentials, and they also want to prevent workloads from being scheduled on the same node as sensitive control-plane components. Which two configurations should they implement?
Select an answer first
8expert · hard
A security engineer is reviewing a Kubernetes cluster that runs untrusted workloads from multiple tenants. The cluster uses a single control plane and multiple worker nodes. The engineer needs to reduce the risk of a compromised workload accessing the Kubernetes API server or other workloads. Which combination of controls is most effective?
Select an answer first
9foundation · easy
In Kubernetes, which resource provides a stable network endpoint (IP address and DNS name) for a set of pods?
Select an answer first
10foundation · easy
Which of the following is a component that runs on a worker node in a Kubernetes cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 2)

Questions 6–10

A company is evaluating container orchestration platforms for a new project. They have a team with limited Kubernetes experience and need to deploy a simple web application that can scale based on HTTP traffic. They also want to minimize operational overhead. Which approach is most appropriate?

In Kubernetes, which resource provides a stable network endpoint (IP address and DNS name) for a set of pods?

Which of the following is a component that runs on a worker node in a Kubernetes cluster?

Keep studying — Container Orchestration Architecture and Security