A security operations center (SOC) is monitoring a Kubernetes cluster for runtime threats. They notice an unusual spike in outbound network traffic from a single pod. Which runtime security tool would be most effective at detecting this anomaly and providing real-time alerts?

Kubernetes audit logging to review API requests.

Falco with a rule that monitors outbound connections to known malicious IP addresses.

Prometheus with a custom exporter that tracks pod network metrics.

Kube-bench to scan the cluster for misconfigurations.

A security architect is designing a runtime security strategy for a Kubernetes cluster that runs a mix of stateful and stateless applications. They want to ensure that any anomalous behavior is detected and that the security team is notified. Which approach should they take?

Deploy a runtime security tool like Falco or Sysdig, configure rules for known threats, and integrate alerts with the SIEM.

Enable Kubernetes audit logging and review the logs manually on a weekly basis.

Use only Kubernetes NetworkPolicies to restrict traffic and prevent attacks.

Use container image scanning to ensure that images are free of vulnerabilities.

In the context of container orchestration, what is the primary purpose of runtime security?

To enforce network policies between pods in the cluster

To protect running workloads by detecting and responding to threats during execution

To scan container images for vulnerabilities before they are deployed

To manage secrets and credentials used by containerized applications

What is the purpose of a runtime security policy in a container orchestration environment?

To restrict the actions a container can perform while running, such as file access or network connections

To define which container images are allowed to be pulled from a registry

To configure the Kubernetes scheduler to place pods on specific nodes

To manage user authentication for the Kubernetes API server

Which activity is an example of runtime security in a Kubernetes cluster?

Running `kube-bench` to check the cluster against CIS benchmarks

Monitoring system calls made by a container to detect unexpected behavior

Configuring Role-Based Access Control (RBAC) for Kubernetes users

Signing container images with a private key before pushing them to a registry

GIAC Cloud Security Automation

Domain 3Objective 3

Runtime Security in Container Orchestration GCSA Practice Questions (Page 1)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

Questions 1–5

1application · medium
A security operations center (SOC) is monitoring a Kubernetes cluster for runtime threats. They notice an unusual spike in outbound network traffic from a single pod. Which runtime security tool would be most effective at detecting this anomaly and providing real-time alerts?
Select an answer first
2application · medium
A security architect is designing a runtime security strategy for a Kubernetes cluster that runs a mix of stateful and stateless applications. They want to ensure that any anomalous behavior is detected and that the security team is notified. Which approach should they take?
Select an answer first
3foundation · easy
In the context of container orchestration, what is the primary purpose of runtime security?
Select an answer first
4foundation · easy
What is the purpose of a runtime security policy in a container orchestration environment?
Select an answer first
5foundation · easy
Which activity is an example of runtime security in a Kubernetes cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.