A security engineer is troubleshooting a containerized application that fails to start after a seccomp profile was applied. The application logs show a 'operation not permitted' error. The engineer suspects the seccomp profile is blocking a required syscall. The application must continue to run with the seccomp profile enabled. Which approach should the engineer take?

Use a different container runtime that does not enforce seccomp profiles.

Use 'strace' to identify the blocked syscall, then add it to the seccomp profile's allowed list.

Set the seccomp profile to 'unconfined' to allow all syscalls.

Run the container in privileged mode to bypass the seccomp profile.

A company has a CI/CD pipeline that builds and pushes container images. They want to enforce that only images that have passed vulnerability scanning and are signed by the CI system can be deployed. They also want to ensure that the image's base image is from an approved list. Which approach should they implement?

Use a policy engine in the cluster to verify signatures and scan results at admission time.

Implement a pipeline gate that fails the build if the image does not pass scanning or is not signed, and use a policy engine to verify at deploy time.

Use a registry that automatically blocks unsigned images.

Manually review each image before deployment.

A DevOps engineer is building a CI pipeline that compiles a Go binary and packages it into a container image. The security team requires that the final image contain no package manager, shell, or compiler toolchain, and that the image be signed before it is pushed to the registry. Which approach satisfies these requirements?

Use an Alpine base image, add the binary, and sign the image with Docker Content Trust after the build.

Use a distroless base image and rely on the registry's built-in signing feature to sign the image automatically.

Use a full Ubuntu base image, install the binary, then remove the package manager and shell in a later layer.

Use a scratch base image, copy the statically compiled binary, and sign the image with cosign after the build.

Which practice is a core component of container image security to reduce the attack surface of a containerized application?

Using a minimal base image such as distroless or Alpine

Running the container as the root user to simplify permission management

Including debugging tools in the image for troubleshooting

Storing image layers in a public registry for transparency

GIAC Cloud Security Automation

Domain 4Objective 1

Container Lifecycle Security GCSA Practice Questions (Page 8)

Part of the Container and Microservices Lifecycle domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A security engineer is troubleshooting a containerized application that fails to start after a seccomp profile was applied. The application logs show a 'operation not permitted' error. The engineer suspects the seccomp profile is blocking a required syscall. The application must continue to run with the seccomp profile enabled. Which approach should the engineer take?
Select an answer first
37expert · hard
A company has a CI/CD pipeline that builds and pushes container images. They want to enforce that only images that have passed vulnerability scanning and are signed by the CI system can be deployed. They also want to ensure that the image's base image is from an approved list. Which approach should they implement?
Select an answer first
38application · medium
A DevOps engineer is building a CI pipeline that compiles a Go binary and packages it into a container image. The security team requires that the final image contain no package manager, shell, or compiler toolchain, and that the image be signed before it is pushed to the registry. Which approach satisfies these requirements?
Select an answer first
39foundation · easy
In Kubernetes, which resource is used to define rules that control network traffic between pods?
Select an answer first
40foundation · easy
Which practice is a core component of container image security to reduce the attack surface of a containerized application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Container Lifecycle Security GCSA Practice Questions (Page 8)

Questions 36–40

In Kubernetes, which resource is used to define rules that control network traffic between pods?

Which practice is a core component of container image security to reduce the attack surface of a containerized application?

Keep studying — Container and Microservices Lifecycle