A company is running a microservices architecture on Kubernetes. They need to ensure that a frontend service can always reach a backend service using a stable DNS name, even when backend pods are scaled up or down. Which Kubernetes resource should they use?

A ConfigMap that lists backend pod IPs.

A NetworkPolicy that allows traffic to backend pods.

A Headless Service with a stable DNS name.

What is the primary role of a scheduler in a container orchestration platform?

To monitor container health and restart failed containers

To store the desired state of the cluster

To assign workloads to nodes based on resource availability and constraints

To expose services to external traffic

A security team is hardening a Kubernetes cluster. They want to ensure that pods cannot access the host network namespace and that all traffic between pods is encrypted. The cluster uses a CNI plugin that supports encryption. Which two configurations should they implement?

Use a Service Mesh with mTLS and set hostNetwork to false in the pod spec.

Set hostNetwork to false in the pod security context and enable encryption in the CNI plugin configuration.

Set privileged to false in the pod security context and use a NetworkPolicy to restrict traffic.

Set the pod security context to runAsNonRoot and enable the CNI plugin's encryption feature.

An organization is running a Kubernetes cluster with a mix of CPU-intensive and memory-intensive workloads. They want to ensure that the cluster scheduler places workloads in a way that maximizes resource utilization while preventing any single node from being overwhelmed. Which set of configurations should they implement?

Use resource quotas per namespace and set pod priority classes.

Set resource requests and limits for each container and configure the scheduler to use the LeastRequestedPriority policy.

Define resource requests and limits for each container and use node affinity rules.

Use node selectors to pin workloads to specific nodes and set taints on nodes with high utilization.

A large organization is running a Kubernetes cluster with multiple node pools across different availability zones. The team needs to ensure that workloads are distributed across zones for high availability, but they also want to minimize cross-zone network traffic for performance. Which scheduling configuration should they use?

Use pod topology spread constraints to distribute pods across zones and node affinity to keep related pods in the same zone.

Use a single node pool in one zone and rely on the cluster autoscaler to add nodes as needed.

Use pod anti-affinity to spread pods across nodes, but do not specify zone-level constraints.

Use a DaemonSet to run a copy of each workload on every node in every zone.

GIAC Cloud Security Automation

Domain 3Objective 1

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 7)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 31–35

31application · medium
A company is running a microservices architecture on Kubernetes. They need to ensure that a frontend service can always reach a backend service using a stable DNS name, even when backend pods are scaled up or down. Which Kubernetes resource should they use?
Select an answer first
32foundation · easy
What is the primary role of a scheduler in a container orchestration platform?
Select an answer first
33application · medium
A security team is hardening a Kubernetes cluster. They want to ensure that pods cannot access the host network namespace and that all traffic between pods is encrypted. The cluster uses a CNI plugin that supports encryption. Which two configurations should they implement?
Select an answer first
34application · medium
An organization is running a Kubernetes cluster with a mix of CPU-intensive and memory-intensive workloads. They want to ensure that the cluster scheduler places workloads in a way that maximizes resource utilization while preventing any single node from being overwhelmed. Which set of configurations should they implement?
Select an answer first
35expert · hard
A large organization is running a Kubernetes cluster with multiple node pools across different availability zones. The team needs to ensure that workloads are distributed across zones for high availability, but they also want to minimize cross-zone network traffic for performance. Which scheduling configuration should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 7)

Questions 31–35

A company is running a microservices architecture on Kubernetes. They need to ensure that a frontend service can always reach a backend service using a stable DNS name, even when backend pods are scaled up or down. Which Kubernetes resource should they use?

What is the primary role of a scheduler in a container orchestration platform?

A security team is hardening a Kubernetes cluster. They want to ensure that pods cannot access the host network namespace and that all traffic between pods is encrypted. The cluster uses a CNI plugin that supports encryption. Which two configurations should they implement?

Keep studying — Container Orchestration Architecture and Security