Your CI/CD pipeline signs container images with a private key. The production cluster has an admission controller that verifies signatures. A developer accidentally pushes an unsigned image to the registry. What will happen when the image is deployed?

The image will be deployed and a warning will be logged

The deployment will be rejected by the admission controller

The image will be deployed but marked as unsigned

The image will be deployed only if the registry allows it

A Kubernetes cluster hosts multiple applications in a shared namespace. One application has a memory leak that causes the node to run out of memory, affecting other workloads. You need to prevent a single workload from exhausting node resources while still allowing the application to run. What should you configure?

Apply a PodSecurityPolicy that restricts privileged containers

Configure a NetworkPolicy to block traffic to the leaking application

Enable Horizontal Pod Autoscaler (HPA) on the leaking application

Set a ResourceQuota for the namespace and a LimitRange with default CPU and memory limits for pods

A security team wants to detect a container that is attempting to mount the host filesystem or execute a binary that is not part of the original image. They plan to use a runtime security tool. Which type of rule should they configure?

Rules that check the container's resource usage against limits.

Rules that scan container images for known vulnerabilities.

Rules that monitor Kubernetes API calls for pod creation.

Rules that monitor syscalls such as mount and execve, and compare against a baseline of known-good behavior.

A Kubernetes cluster has a namespace with a ResourceQuota that limits CPU to 10 cores and memory to 20 Gi. A new deployment requests 2 cores and 4 Gi per pod. The deployment fails to schedule. What is the most likely cause?

The namespace ResourceQuota is already exhausted by existing workloads

The deployment does not specify a LimitRange

The pod uses a privileged security context

The pod requests exceed the node's allocatable resources

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 1)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 1–5

1expert · hard
Your CI/CD pipeline signs container images with a private key. The production cluster has an admission controller that verifies signatures. A developer accidentally pushes an unsigned image to the registry. What will happen when the image is deployed?
Select an answer first
2application · medium
A Kubernetes cluster hosts multiple applications in a shared namespace. One application has a memory leak that causes the node to run out of memory, affecting other workloads. You need to prevent a single workload from exhausting node resources while still allowing the application to run. What should you configure?
Select an answer first
3foundation · easy
Which orchestration-level construct is used to provide network isolation between groups of container workloads?
Select an answer first
4application · medium
A security team wants to detect a container that is attempting to mount the host filesystem or execute a binary that is not part of the original image. They plan to use a runtime security tool. Which type of rule should they configure?
Select an answer first
5expert · hard
A Kubernetes cluster has a namespace with a ResourceQuota that limits CPU to 10 cores and memory to 20 Gi. A new deployment requests 2 cores and 4 Gi per pod. The deployment fails to schedule. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Workload Security in Container Orchestration GCSA Practice Questions (Page 1)

Questions 1–5

Your CI/CD pipeline signs container images with a private key. The production cluster has an admission controller that verifies signatures. A developer accidentally pushes an unsigned image to the registry. What will happen when the image is deployed?

Which orchestration-level construct is used to provide network isolation between groups of container workloads?

A security team wants to detect a container that is attempting to mount the host filesystem or execute a binary that is not part of the original image. They plan to use a runtime security tool. Which type of rule should they configure?

A Kubernetes cluster has a namespace with a ResourceQuota that limits CPU to 10 cores and memory to 20 Gi. A new deployment requests 2 cores and 4 Gi per pod. The deployment fails to schedule. What is the most likely cause?

Keep studying — Container Orchestration Architecture and Security