A security analyst notices that a container workload is behaving unexpectedly: it is spawning processes outside its declared command and attempting to write to system directories. The image was scanned and signed at build time. What should be implemented to detect and respond to such behavior in real time?

Set the container's securityContext to readOnlyRootFilesystem: true.

Deploy a runtime security agent (e.g., Falco) with rules that alert on unexpected process execution and file writes.

Re-scan the image with a different scanner to check for malware.

Enable Kubernetes audit logging on the API server.

What is the purpose of a service mesh (e.g., Istio) in the context of workload identity and authentication?

To scan container images for vulnerabilities

To enforce resource quotas on namespaces

To manage secrets in the cluster

To provide mutual TLS and identity-based authentication between services

Two microservices in the same Kubernetes cluster need to authenticate each other for API calls. The cluster uses a service mesh with mTLS. Which configuration provides secure service-to-service authentication?

Use the default ServiceAccount for both microservices and rely on network policies

Store a shared API key in a Kubernetes Secret and mount it in both pods

Enable Kubernetes audit logging for API calls

Assign distinct Kubernetes ServiceAccounts to each microservice and enable mTLS in the service mesh

A development team wants to store database credentials in Kubernetes Secrets. They are concerned about secrets being visible to anyone with access to the etcd database. What should they do to protect secrets at rest?

Enable encryption at rest for etcd using a KMS provider.

Store secrets in a ConfigMap instead of a Secret.

Set the secret's type to kubernetes.io/tls to automatically encrypt it.

Use a ServiceAccount token as the database password.

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 4)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 16–20

16application · medium
A security analyst notices that a container workload is behaving unexpectedly: it is spawning processes outside its declared command and attempting to write to system directories. The image was scanned and signed at build time. What should be implemented to detect and respond to such behavior in real time?
Select an answer first
17foundation · easy
What is the purpose of a service mesh (e.g., Istio) in the context of workload identity and authentication?
Select an answer first
18application · medium
Two microservices in the same Kubernetes cluster need to authenticate each other for API calls. The cluster uses a service mesh with mTLS. Which configuration provides secure service-to-service authentication?
Select an answer first
19application · medium
A development team wants to store database credentials in Kubernetes Secrets. They are concerned about secrets being visible to anyone with access to the etcd database. What should they do to protect secrets at rest?
Select an answer first
20foundation · easy
Which Kubernetes resource is used to set aggregate resource consumption limits for all pods in a namespace?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Workload Security in Container Orchestration GCSA Practice Questions (Page 4)

Questions 16–20

What is the purpose of a service mesh (e.g., Istio) in the context of workload identity and authentication?

Two microservices in the same Kubernetes cluster need to authenticate each other for API calls. The cluster uses a service mesh with mTLS. Which configuration provides secure service-to-service authentication?

A development team wants to store database credentials in Kubernetes Secrets. They are concerned about secrets being visible to anyone with access to the etcd database. What should they do to protect secrets at rest?

Which Kubernetes resource is used to set aggregate resource consumption limits for all pods in a namespace?

Keep studying — Container Orchestration Architecture and Security