A security team is reviewing a Kubernetes cluster that uses a service mesh for inter-service communication. They need to ensure that all traffic between services is encrypted and that services cannot communicate with each other unless explicitly allowed. Which set of controls should they implement?

Enable mTLS in the service mesh and define authorization policies that allow only specific service-to-service communications.

Disable the service mesh and use a VPN for all inter-service traffic.

Use a single service account for all services and rely on the service mesh for encryption.

Use NetworkPolicies to allow all traffic and rely on the service mesh for encryption.

A DevOps team is deploying a new version of a microservice. They want to perform a rolling update with zero downtime and automatically roll back if the new version fails health checks. Which Kubernetes feature should they configure?

A StatefulSet with a liveness probe and a strategy of OnDelete.

A Deployment with a readiness probe and a strategy of RollingUpdate.

A DaemonSet with a readiness probe and a strategy of RollingUpdate.

A Job with a liveness probe and a restart policy of OnFailure.

What is the purpose of a Kubernetes NetworkPolicy?

To limit resource usage of pods

To encrypt data at rest in etcd

To manage user authentication to the cluster

To control traffic flow between pods and services at the network layer

A company is setting up a Kubernetes cluster for development and production environments. They want to ensure that development workloads cannot affect production workloads and that each environment has its own set of resources. Which approach should they use?

Use the same namespace for both environments and rely on labels to distinguish them.

Use separate clusters for development and production.

Use separate namespaces for development and production, and apply ResourceQuotas to each.

Use a single cluster and rely on network policies to isolate environments.

A security engineer is reviewing a Kubernetes cluster that runs a mix of trusted and untrusted workloads. They need to ensure that untrusted workloads cannot access the Kubernetes API server, but trusted workloads can. They also want to prevent untrusted workloads from accessing other workloads in the cluster. Which set of controls should they implement?

Use a separate cluster for untrusted workloads.

Use RBAC to restrict API access for untrusted workloads and NetworkPolicies to isolate them from other workloads.

Use a separate namespace for untrusted workloads and rely on namespace isolation.

Use a service mesh with mTLS and authorization policies.

GIAC Cloud Security Automation

Domain 3Objective 1

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 3)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 11–15

11expert · hard
A security team is reviewing a Kubernetes cluster that uses a service mesh for inter-service communication. They need to ensure that all traffic between services is encrypted and that services cannot communicate with each other unless explicitly allowed. Which set of controls should they implement?
Select an answer first
12application · medium
A DevOps team is deploying a new version of a microservice. They want to perform a rolling update with zero downtime and automatically roll back if the new version fails health checks. Which Kubernetes feature should they configure?
Select an answer first
13foundation · easy
What is the purpose of a Kubernetes NetworkPolicy?
Select an answer first
14application · medium
A company is setting up a Kubernetes cluster for development and production environments. They want to ensure that development workloads cannot affect production workloads and that each environment has its own set of resources. Which approach should they use?
Select an answer first
15expert · hard
A security engineer is reviewing a Kubernetes cluster that runs a mix of trusted and untrusted workloads. They need to ensure that untrusted workloads cannot access the Kubernetes API server, but trusted workloads can. They also want to prevent untrusted workloads from accessing other workloads in the cluster. Which set of controls should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.