A security engineer is configuring a container runtime for a multi-tenant environment. They need to prevent a compromised container from affecting other containers on the same host. They also want to monitor for unusual system call activity. Which two measures should they implement?

Use only cgroups to limit CPU and memory, and skip system call filtering.

Run all containers with privileged mode and rely on the kernel's default security.

Use the host network namespace and disable seccomp for performance.

Enable seccomp profiles and use a runtime like gVisor.

An organization uses a private container registry to store production images. They want to ensure that only approved images are deployed and that any image pulled from the registry has not been tampered with. Which combination of controls should they implement?

Enable vulnerability scanning and enforce image signing with a trusted key.

Restrict registry access to a private network and rely on the network firewall.

Implement RBAC on the registry and require multi-factor authentication for all users.

Use a unique tag for each build and store images in a private registry.

A company's CI/CD pipeline builds a container image from source code and pushes it to a registry. The security team wants to ensure that the image was built from the exact commit that passed code review and that no unauthorized changes were introduced during the build. What should they implement?

Store the Dockerfile in a private repository and restrict access to the CI system.

Use a base image that is updated daily and rely on the registry's built-in scanning.

Use a multi-stage build to minimize the final image size.

Record the Git commit SHA in the image label and sign the image with a key held by the CI system.

Which CI/CD security control is most effective at preventing vulnerable images from being deployed?

Running vulnerability scans on images and failing the pipeline if critical issues are found

Storing all images in a public registry for community review

Manually reviewing images after deployment

Using a fast build process to reduce the time to deployment

What is the primary advantage of using a private container registry over a public one?

It allows for stricter access control and reduces exposure of proprietary images

It provides better performance for image pulls

It eliminates the need for image signing

It automatically scans images for vulnerabilities

GIAC Cloud Security Automation

Domain 4Objective 1

Container Lifecycle Security GCSA Practice Questions (Page 3)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 11–15

11application · medium
A security engineer is configuring a container runtime for a multi-tenant environment. They need to prevent a compromised container from affecting other containers on the same host. They also want to monitor for unusual system call activity. Which two measures should they implement?
Select an answer first
12application · medium
An organization uses a private container registry to store production images. They want to ensure that only approved images are deployed and that any image pulled from the registry has not been tampered with. Which combination of controls should they implement?
Select an answer first
13application · medium
A company's CI/CD pipeline builds a container image from source code and pushes it to a registry. The security team wants to ensure that the image was built from the exact commit that passed code review and that no unauthorized changes were introduced during the build. What should they implement?
Select an answer first
14foundation · easy
Which CI/CD security control is most effective at preventing vulnerable images from being deployed?
Select an answer first
15foundation · easy
What is the primary advantage of using a private container registry over a public one?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.