A security operations team wants to detect anomalous behavior in a containerized application, such as unexpected network connections or attempts to write to sensitive host paths. The team already collects container logs and metrics. Which additional control should be implemented to meet this goal?

Use a vulnerability scanner to continuously scan the container image for new vulnerabilities.

Deploy a runtime security agent that monitors syscalls and container events, and alert on deviations from a defined baseline.

Enable Kubernetes audit logging and review the logs for unauthorized API calls.

Increase the verbosity of the application's logs and use a log aggregation tool to search for error messages.

What does 'image provenance' refer to in container supply chain security?

The history of the image's creation, including its base image and build process

The number of layers in the image

The license of the software inside the image

The performance metrics of the image at runtime

What is the primary purpose of auditing container environments?

To automatically patch vulnerabilities

To improve container performance

To reduce the number of containers in the environment

To track security events and ensure compliance with policies and regulations

A company's CI/CD pipeline builds container images from source code and pushes them to a private registry. The security team wants to ensure that the images are built from trusted source code and that the build process itself is not tampered with. Which control should be added to the pipeline?

Use a container image scanner in the pipeline to check for known vulnerabilities before pushing.

Use a private Git repository and restrict access to the repository with SSH keys.

Use a Dockerfile linter to ensure the Dockerfile follows best practices.

Use a signed commit requirement and a reproducible build process that records the source commit hash in the image label.

GIAC Cloud Security Automation

Domain 4Objective 1

Container Lifecycle Security GCSA Practice Questions (Page 7)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 31–35

31application · medium
A security operations team wants to detect anomalous behavior in a containerized application, such as unexpected network connections or attempts to write to sensitive host paths. The team already collects container logs and metrics. Which additional control should be implemented to meet this goal?
Select an answer first
32foundation · easy
What does 'image provenance' refer to in container supply chain security?
Select an answer first
33foundation · easy
What is the primary purpose of auditing container environments?
Select an answer first
34foundation · easy
Which Kubernetes feature is specifically designed to store sensitive data such as passwords and API keys?
Select an answer first
35application · medium
A company's CI/CD pipeline builds container images from source code and pushes them to a private registry. The security team wants to ensure that the images are built from trusted source code and that the build process itself is not tampered with. Which control should be added to the pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.