A Kubernetes cluster uses a private registry for all images. The security team wants to ensure that only images from this registry can be deployed, and that the service accounts used by pods have the minimum permissions necessary. Which controls should be implemented?

Use RBAC to restrict which users can create pods, and rely on the developers to use only the private registry.

Use an admission controller to validate that the image registry is the allowed private registry, and use RBAC to restrict service account permissions.

Use a secret to store the private registry credentials and configure the kubelet to pull images only from the private registry.

Use a NetworkPolicy to block traffic to the public registry, and use a PodSecurityPolicy to restrict service account permissions.

A platform team wants to enforce that every container image pushed to the production registry has passed a vulnerability scan and is signed by the CI system. The team wants to automate this enforcement without requiring manual review. Which approach should be used?

Use a Kubernetes admission controller to scan the image at deployment time and reject the deployment if the image is not signed.

Use a cron job to periodically scan all images in the registry and remove any that are not signed.

Configure the CI pipeline to run the scanner and sign the image only if the scan passes, and use a registry webhook to reject unsigned or unscanned images.

Use a pre-commit hook in the source repository to scan the Dockerfile and require a developer to manually sign the image after the build.

A company wants to automate security checks across the container lifecycle. They have a CI/CD pipeline and a Kubernetes cluster. Which of the following are effective ways to automate security enforcement? (Select all that apply.)

Use a runtime security tool to automatically block suspicious behavior.

Use a manual approval process for every image deployment.

Use a pre-commit hook to scan Dockerfiles for insecure patterns.

Use an admission controller to verify image signatures and enforce policies at deploy time.

Use a CI pipeline step to run vulnerability scanning and fail the build if critical vulnerabilities are found.

An organization uses a private container registry to store images for production deployments. The security team wants to ensure that only approved images are deployed and that images are scanned for vulnerabilities before they are pulled. Which combination of controls should be implemented?

Restrict access to the registry with RBAC and rely on the registry's access logs to detect unauthorized pulls.

Use a private registry and manually review each image's Dockerfile before pushing it to the registry.

Enable image signing with cosign and configure the cluster to verify signatures before pulling, and enable the registry's built-in vulnerability scanning.

Use a public registry and rely on its built-in vulnerability scanning to block vulnerable images.

A Kubernetes cluster hosts multiple microservices. The security team wants to ensure that only the 'payment' service can communicate with the 'database' service, and that no other service can reach the database. They also want to enforce this at the network layer. What should they implement?

A Secret that contains the database password and mount it only into the payment service.

A container image scanning policy that only allows the payment image to be deployed.

An RBAC role that grants the payment service permission to access the database service.

A Kubernetes NetworkPolicy that allows ingress to the database pod only from the payment service's pods.

GIAC Cloud Security Automation

Domain 4Objective 1

Container Lifecycle Security GCSA Practice Questions (Page 5)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 21–25

21application · medium
A Kubernetes cluster uses a private registry for all images. The security team wants to ensure that only images from this registry can be deployed, and that the service accounts used by pods have the minimum permissions necessary. Which controls should be implemented?
Select an answer first
22application · medium
A platform team wants to enforce that every container image pushed to the production registry has passed a vulnerability scan and is signed by the CI system. The team wants to automate this enforcement without requiring manual review. Which approach should be used?
Select an answer first
23expert · hard · select all that apply
A company wants to automate security checks across the container lifecycle. They have a CI/CD pipeline and a Kubernetes cluster. Which of the following are effective ways to automate security enforcement? (Select all that apply.)
Select an answer first
24application · medium
An organization uses a private container registry to store images for production deployments. The security team wants to ensure that only approved images are deployed and that images are scanned for vulnerabilities before they are pulled. Which combination of controls should be implemented?
Select an answer first
25application · medium
A Kubernetes cluster hosts multiple microservices. The security team wants to ensure that only the 'payment' service can communicate with the 'database' service, and that no other service can reach the database. They also want to enforce this at the network layer. What should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.