A security architect is designing a multi-tenant container platform. They need to provide strong isolation between tenants, but they also need to minimize performance overhead and support applications that require direct hardware access (e.g., GPU). Which isolation approach best balances these requirements?

Use a mix: hardware virtualization for untrusted tenants and standard containers with seccomp for trusted tenants that need GPU access.

Use hardware virtualization (e.g., Kata Containers) for all tenants.

Use standard Linux namespaces and cgroups with seccomp and AppArmor.

What is the role of admission controllers in Kubernetes security automation?

To scan container images for vulnerabilities at runtime

To manage network traffic between pods

To intercept requests to the Kubernetes API server and enforce security policies before objects are persisted

A security admin is deploying a container that needs to bind to a port below 1024 on the host. They want to follow the principle of least privilege. What should they do?

Use a privileged container to ensure the port binding works.

Add the NET_BIND_SERVICE capability to the container and drop all other capabilities.

Set the container's user ID to 0 and rely on the kernel's default capabilities.

Run the container as root and use the host network.

A Kubernetes administrator needs to grant a CI/CD service account the ability to create and manage pods only in the 'staging' namespace, but not in 'production'. What should they configure?

Use a NetworkPolicy to block the CI system from reaching the production API server.

Create a Secret with the service account token and share it with the CI system.

Create a Role and RoleBinding in the 'staging' namespace that grants the necessary pod permissions.

Create a ClusterRole and ClusterRoleBinding that grants pod permissions.

Which approach best automates security enforcement across the container lifecycle?

Performing manual security reviews before each release

Relying on developers to remember security best practices

Using a single security scan at the end of the development cycle

Integrating security tools into CI/CD pipelines and using admission controllers at deploy time

GIAC Cloud Security Automation

Domain 4Objective 1

Container Lifecycle Security GCSA Practice Questions (Page 6)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 26–30

26expert · hard
A security architect is designing a multi-tenant container platform. They need to provide strong isolation between tenants, but they also need to minimize performance overhead and support applications that require direct hardware access (e.g., GPU). Which isolation approach best balances these requirements?
Select an answer first
27foundation · easy
What is the role of admission controllers in Kubernetes security automation?
Select an answer first
28application · medium
A security admin is deploying a container that needs to bind to a port below 1024 on the host. They want to follow the principle of least privilege. What should they do?
Select an answer first
29application · medium
A Kubernetes administrator needs to grant a CI/CD service account the ability to create and manage pods only in the 'staging' namespace, but not in 'production'. What should they configure?
Select an answer first
30foundation · easy
Which approach best automates security enforcement across the container lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.