A platform team is running a Kubernetes cluster with a mix of workloads. Some workloads are critical and must always run, while others are batch jobs that can be preempted. The team needs to ensure that critical workloads are scheduled first and that batch jobs do not consume resources needed by critical workloads. Which Kubernetes feature should they use?

Assign different PriorityClasses to the workloads and set resource requests and limits for each pod.

Use a custom scheduler for batch jobs and the default scheduler for critical workloads.

Create separate namespaces for critical and batch workloads and use ResourceQuotas.

Use node affinity to pin critical workloads to specific nodes and batch jobs to other nodes.

What is the purpose of a HorizontalPodAutoscaler (HPA) in Kubernetes?

To scale the cluster nodes automatically

To automatically scale the number of pod replicas based on observed metrics

To update pods to a new version

To distribute traffic across pods

A security team is hardening a Kubernetes cluster. They want to ensure that containers cannot run as the root user, that the container filesystem is read-only, and that containers cannot access the host's network namespace. Which set of policies should they implement?

A PodSecurityPolicy that sets runAsNonRoot: true, readOnlyRootFilesystem: true, and hostNetwork: false.

A ResourceQuota that limits CPU and memory.

A LimitRange that sets default requests and limits.

A NetworkPolicy that denies all ingress and egress traffic.

GIAC Cloud Security Automation

Domain 3Objective 1

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 5)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 21–25

21application · medium
A platform team is running a Kubernetes cluster with a mix of workloads. Some workloads are critical and must always run, while others are batch jobs that can be preempted. The team needs to ensure that critical workloads are scheduled first and that batch jobs do not consume resources needed by critical workloads. Which Kubernetes feature should they use?
Select an answer first
22foundation · easy
What is the purpose of a HorizontalPodAutoscaler (HPA) in Kubernetes?
Select an answer first
23foundation · easy
Which Kubernetes feature allows you to update a Deployment with zero downtime by gradually replacing old pods with new ones?
Select an answer first
24application · medium
A security team is hardening a Kubernetes cluster. They want to ensure that containers cannot run as the root user, that the container filesystem is read-only, and that containers cannot access the host's network namespace. Which set of policies should they implement?
Select an answer first
25foundation · easy
In a Kubernetes cluster, which component is responsible for maintaining the desired state of the cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 5)

Questions 21–25

What is the purpose of a HorizontalPodAutoscaler (HPA) in Kubernetes?

Which Kubernetes feature allows you to update a Deployment with zero downtime by gradually replacing old pods with new ones?

A security team is hardening a Kubernetes cluster. They want to ensure that containers cannot run as the root user, that the container filesystem is read-only, and that containers cannot access the host's network namespace. Which set of policies should they implement?

In a Kubernetes cluster, which component is responsible for maintaining the desired state of the cluster?

Keep studying — Container Orchestration Architecture and Security