A development team builds a container image that includes a base image from a public registry. The security team requires that the image be scanned for vulnerabilities and that the base image's provenance be verified before the image is used in production. Which combination of actions should be taken?

Use a minimal base image from a trusted source, scan the final image with a vulnerability scanner, and verify the base image's digest and signature.

Use a base image that is known to have no vulnerabilities and skip the scan to save time.

Use the latest tag of the base image and scan the final image with a vulnerability scanner.

Use a base image from a public registry and rely on the registry's reputation to ensure it is safe.

What is the primary purpose of signing a container image?

To automatically fix vulnerabilities found in the image

To verify the image's integrity and authenticity

To compress the image for faster transfer

To encrypt the image so only authorized users can pull it

A security team is deploying a containerized application that processes untrusted user-supplied files. They want to limit the impact of a potential container escape. They have decided to use a sandboxing solution that provides a user-space kernel interface. Which technology should they choose?

Docker's default runtime with seccomp profiles

A security engineer is designing a CI/CD pipeline for a containerized application. The pipeline must ensure that the source code is reviewed, the build environment is isolated, and the resulting image is signed. Which set of controls should be included?

Use a pre-built base image and skip the source code review to speed up the pipeline.

Require pull request approvals, run the build in a dedicated ephemeral container, and sign the image with a key stored in a secrets manager.

Run the build on the developer's local machine and sign the image with the developer's personal key.

Use a shared build server and require that the developer manually approve the build before it is signed.

GIAC Cloud Security Automation

Domain 4Objective 1

Container Lifecycle Security GCSA Practice Questions (Page 4)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 16–20

16foundation · easy
Which Linux feature provides isolation of process IDs, network interfaces, and mount points for containers?
Select an answer first
17application · medium
A development team builds a container image that includes a base image from a public registry. The security team requires that the image be scanned for vulnerabilities and that the base image's provenance be verified before the image is used in production. Which combination of actions should be taken?
Select an answer first
18foundation · easy
What is the primary purpose of signing a container image?
Select an answer first
19application · medium
A security team is deploying a containerized application that processes untrusted user-supplied files. They want to limit the impact of a potential container escape. They have decided to use a sandboxing solution that provides a user-space kernel interface. Which technology should they choose?
Select an answer first
20application · medium
A security engineer is designing a CI/CD pipeline for a containerized application. The pipeline must ensure that the source code is reviewed, the build environment is isolated, and the resulting image is signed. Which set of controls should be included?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Container Lifecycle Security GCSA Practice Questions (Page 4)

Questions 16–20

Which Linux feature provides isolation of process IDs, network interfaces, and mount points for containers?

What is the primary purpose of signing a container image?

A security team is deploying a containerized application that processes untrusted user-supplied files. They want to limit the impact of a potential container escape. They have decided to use a sandboxing solution that provides a user-space kernel interface. Which technology should they choose?

A security engineer is designing a CI/CD pipeline for a containerized application. The pipeline must ensure that the source code is reviewed, the build environment is isolated, and the resulting image is signed. Which set of controls should be included?

Keep studying — Container and Microservices Lifecycle