How does Kubernetes admission control integrate with runtime security tools?

Admission controllers manage network policies between pods

Admission controllers scan container images for vulnerabilities

Admission controllers can block or modify pod creation requests before they are persisted

Admission controllers monitor system calls of running containers

A security team wants to detect anomalous behavior in their Kubernetes cluster, such as a container spawning a process that is not in the container image's original process tree. They have a SIEM that can receive alerts. Which tool and configuration would best meet this need?

Deploy Falco as a DaemonSet and enable the 'k8saudit' plugin to send Kubernetes audit logs to the SIEM.

Enable Kubernetes audit logging at the Request level and ship the logs to the SIEM, then create a dashboard for pod exec events.

Use Prometheus to monitor container process counts and set an alert for any spike in process creation.

Deploy Sysdig Agent and configure a runtime policy that triggers on 'spawn_process' events, then send alerts to the SIEM via webhook.

A company is deploying a new microservices application on Kubernetes. The security team wants to ensure that only approved container images are used and that containers cannot run with elevated privileges. Which combination of controls should they implement?

Kubernetes audit logging to record image usage and a manual review process.

ImagePolicyWebhook to validate image provenance and Pod Security Admission to enforce the restricted policy.

Use a mutating admission webhook to automatically add a non-root security context to all pods.

NetworkPolicy to restrict pod-to-pod communication and ResourceQuota to limit resources.

A Kubernetes administrator wants to enforce a policy that prevents containers from running as the root user. They also want to ensure that any violation is logged and the pod is not created. Which mechanism should they use?

Kubernetes audit logging to detect root containers after creation

ResourceQuota that limits the number of pods running as root

Pod Security Admission with the restricted policy

NetworkPolicy that blocks traffic from root containers

GIAC Cloud Security Automation

Domain 3Objective 3

Runtime Security in Container Orchestration GCSA Practice Questions (Page 6)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

Questions 26–30

26foundation · easy
How does Kubernetes admission control integrate with runtime security tools?
Select an answer first
27application · medium
A security analyst is evaluating runtime security tools for a Kubernetes environment. The team needs a tool that can detect anomalous process execution, file system access, and network connections inside containers, and also enforce custom rules. Which tool is best suited for this requirement?
Select an answer first
28application · medium
A security team wants to detect anomalous behavior in their Kubernetes cluster, such as a container spawning a process that is not in the container image's original process tree. They have a SIEM that can receive alerts. Which tool and configuration would best meet this need?
Select an answer first
29application · medium
A company is deploying a new microservices application on Kubernetes. The security team wants to ensure that only approved container images are used and that containers cannot run with elevated privileges. Which combination of controls should they implement?
Select an answer first
30application · medium
A Kubernetes administrator wants to enforce a policy that prevents containers from running as the root user. They also want to ensure that any violation is logged and the pod is not created. Which mechanism should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.