What is the primary purpose of enabling audit logging on a container orchestrator's control plane?

To improve performance by caching API requests

To record a chronological trail of API requests for security analysis

To encrypt data at rest in etcd

To automatically block malicious requests

A large enterprise runs a shared Kubernetes cluster with multiple business units. They must prevent one business unit from accessing another's secrets, while still allowing a central platform team to manage cluster-wide resources. Which approach best satisfies these conflicting requirements?

Create a single namespace for all business units and use network policies to isolate traffic.

Grant all users the 'admin' ClusterRole and rely on trust between business units.

Disable RBAC and use a webhook admission controller to enforce access.

Use namespaces per business unit, bind business-unit users to Roles limited to their namespace, and grant the platform team a ClusterRole for cluster-scoped resources.

In Kubernetes, which mechanism is used to authenticate a pod to the Kubernetes API server?

A client certificate signed by the cluster CA

A username and password stored in a ConfigMap

An SSH key pair generated at pod creation

A service account token mounted into the pod

A security team is concerned about the risk of a compromised container escaping to the host and affecting other tenants in a shared Kubernetes cluster. Which control is most effective at reducing this risk?

Enable the Kubernetes dashboard to monitor container activity.

Run containers with a read-only root filesystem, drop all capabilities, and run as a non-root user.

Use the same service account for all workloads to simplify management.

Set the container's privileged flag to true to allow it to run with full host access.

GIAC Cloud Security Automation

Domain 3Objective 2

Risks, Authentication, and Access-Control of Container Orchestration GCSA Practice Questions (Page 3)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 11–15

11foundation · easy
What is the primary purpose of enabling audit logging on a container orchestrator's control plane?
Select an answer first
12expert · hard
A large enterprise runs a shared Kubernetes cluster with multiple business units. They must prevent one business unit from accessing another's secrets, while still allowing a central platform team to manage cluster-wide resources. Which approach best satisfies these conflicting requirements?
Select an answer first
13foundation · easy
Which Kubernetes object provides a logical boundary for isolating resources and applying access-control policies within a cluster?
Select an answer first
14foundation · easy
In Kubernetes, which mechanism is used to authenticate a pod to the Kubernetes API server?
Select an answer first
15application · medium
A security team is concerned about the risk of a compromised container escaping to the host and affecting other tenants in a shared Kubernetes cluster. Which control is most effective at reducing this risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.