A Kubernetes cluster is shared by multiple teams. One team's workload is consuming excessive CPU, causing performance degradation for other teams. You need to enforce CPU limits per pod and per namespace without affecting the ability to deploy new workloads. What should you configure?

Create a ResourceQuota for each namespace and a LimitRange that sets default CPU requests and limits for pods

Apply a PodSecurityPolicy that requires non-root containers

Enable Vertical Pod Autoscaler (VPA) to adjust CPU requests automatically

Use a NetworkPolicy to limit traffic to the CPU-heavy workload

A security auditor asks how your Kubernetes cluster isolates workloads at the process, filesystem, and network levels. Which statement accurately describes the default isolation mechanisms?

Containers are isolated by default at the hypervisor level, similar to virtual machines

Each container runs its own kernel, providing full hardware-level isolation

Kubernetes automatically applies a default NetworkPolicy that blocks all inter-pod traffic

Containers share the host kernel but have isolated process namespaces, filesystem layers, and network namespaces; network policies provide additional traffic isolation

A compliance team requires that secrets be encrypted at rest and that access to secrets be audited. You are using Kubernetes Secrets with encryption at rest enabled. Which additional control is necessary to meet the audit requirement?

Enable encryption at rest for etcd

Restrict Secret access to specific ServiceAccounts

Enable audit logging for Secret read and write operations

Use a third-party secrets management system like HashiCorp Vault

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 3)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
Which Kubernetes resource is used to define rules for allowed ingress and egress traffic between pods?
Select an answer first
12application · medium
A Kubernetes cluster is shared by multiple teams. One team's workload is consuming excessive CPU, causing performance degradation for other teams. You need to enforce CPU limits per pod and per namespace without affecting the ability to deploy new workloads. What should you configure?
Select an answer first
13foundation · easy
In a container orchestration platform, which mechanism primarily provides process-level isolation for container workloads?
Select an answer first
14application · medium
A security auditor asks how your Kubernetes cluster isolates workloads at the process, filesystem, and network levels. Which statement accurately describes the default isolation mechanisms?
Select an answer first
15expert · hard
A compliance team requires that secrets be encrypted at rest and that access to secrets be audited. You are using Kubernetes Secrets with encryption at rest enabled. Which additional control is necessary to meet the audit requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Workload Security in Container Orchestration GCSA Practice Questions (Page 3)

Questions 11–15

Which Kubernetes resource is used to define rules for allowed ingress and egress traffic between pods?

A Kubernetes cluster is shared by multiple teams. One team's workload is consuming excessive CPU, causing performance degradation for other teams. You need to enforce CPU limits per pod and per namespace without affecting the ability to deploy new workloads. What should you configure?

In a container orchestration platform, which mechanism primarily provides process-level isolation for container workloads?

A security auditor asks how your Kubernetes cluster isolates workloads at the process, filesystem, and network levels. Which statement accurately describes the default isolation mechanisms?

A compliance team requires that secrets be encrypted at rest and that access to secrets be audited. You are using Kubernetes Secrets with encryption at rest enabled. Which additional control is necessary to meet the audit requirement?

Keep studying — Container Orchestration Architecture and Security