A DevOps team wants to allow a CI/CD pipeline to deploy applications to a specific Kubernetes namespace without granting cluster-admin rights. The pipeline uses a service account token for authentication. What is the best practice to achieve this?

Create a dedicated service account, bind it to a Role with deploy permissions in the target namespace, and use its token in the pipeline.

Disable RBAC for the cluster so the pipeline can deploy without permission checks.

Use the default service account in the kube-system namespace for the pipeline.

Generate a static token for a user and add it to a ClusterRoleBinding.

An organization wants to enforce that only workloads with a specific label can communicate with a database pod in the production namespace. Which access-control policy should be applied?

Apply a PodSecurityPolicy that requires the frontend pod to run as non-root.

Create a NetworkPolicy that allows ingress to the database pod only from pods with the label 'app=frontend'.

Set the database pod's service type to ClusterIP and rely on kube-proxy to filter traffic.

Create a RoleBinding that grants the database pod's service account access to the frontend pod.

What is the primary purpose of using RBAC in a container orchestration platform?

To enforce least-privilege access for users and workloads

To isolate containers at the kernel level

To encrypt all network traffic between pods

To automatically scale applications based on load

A security auditor requires that all administrative actions on the Kubernetes cluster be traceable to a specific user. Which control should be enabled?

Enable audit logging on the API server with a policy that captures all write operations and the user identity.

Use a shared service account for all administrators.

Enable verbose logging on all worker nodes.

Enable the Kubernetes dashboard for all administrators.

A security team is investigating a suspected compromise of a Kubernetes cluster. They need to determine which user or service account performed a specific kubectl delete command on a deployment. Which data source should they examine?

The kubelet logs on the worker node where the deployment was running.

The API server audit logs, which record the user, action, and resource for each request.

The container logs of the deleted deployment's pods.

The deployment's YAML file stored in etcd.

GIAC Cloud Security Automation

Domain 3Objective 2

Risks, Authentication, and Access-Control of Container Orchestration GCSA Practice Questions (Page 6)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 26–30

26application · medium
A DevOps team wants to allow a CI/CD pipeline to deploy applications to a specific Kubernetes namespace without granting cluster-admin rights. The pipeline uses a service account token for authentication. What is the best practice to achieve this?
Select an answer first
27application · medium
An organization wants to enforce that only workloads with a specific label can communicate with a database pod in the production namespace. Which access-control policy should be applied?
Select an answer first
28foundation · easy
What is the primary purpose of using RBAC in a container orchestration platform?
Select an answer first
29application · medium
A security auditor requires that all administrative actions on the Kubernetes cluster be traceable to a specific user. Which control should be enabled?
Select an answer first
30expert · hard
A security team is investigating a suspected compromise of a Kubernetes cluster. They need to determine which user or service account performed a specific kubectl delete command on a deployment. Which data source should they examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.