A security auditor is reviewing a Kubernetes cluster that hosts multi-tenant workloads. The auditor wants to ensure that a container breakout in one tenant's pod does not expose other tenants' data or processes. Which set of controls should the administrator verify?

Pods run with non-root user, read-only root filesystem, and a seccomp profile that blocks dangerous syscalls.

Pods run with privileged: true and hostNetwork: true for performance.

Pods run with a ServiceAccount that has cluster-admin permissions.

Pods run with resource limits but no securityContext settings.

Your organization wants to ensure that only images from approved registries and with no critical vulnerabilities are deployed. You have a policy engine (e.g., OPA/Gatekeeper) installed. Which policy should you implement?

A policy that validates the image registry and requires a vulnerability scan result with no critical findings

A policy that requires all pods to run as non-root

A policy that requires all images to have the latest tag

A policy that denies all pods with hostNetwork access

A security team wants to ensure that only images from their approved registry are used in the cluster. They also want to block images with critical vulnerabilities from being deployed. Which mechanism should they use?

Use a Pod Security Admission restricted profile to block non-approved images.

Use a runtime security agent to quarantine pods running non-approved images.

Use a NetworkPolicy to block traffic to non-approved registries.

Use an admission controller that validates the image registry and checks vulnerability scan results.

A company runs a Kubernetes cluster with multiple services that need to communicate securely. They want to ensure that each service has a unique identity and that traffic between services is encrypted. They also want to avoid managing certificates manually. Which solution should they implement?

Use a ServiceAccount token for each service and configure the application to use it as a TLS certificate.

Use Kubernetes Secrets to distribute a shared TLS certificate to all services.

Deploy a service mesh with automatic mTLS and SPIFFE-based identities.

Use a NetworkPolicy to allow all traffic between services and rely on the cluster's internal network.

What is the primary function of runtime security monitoring in a container orchestration environment?

Scanning images for vulnerabilities before deployment

Detecting and responding to malicious activity inside running containers

Managing user access to the cluster API

Encrypting data at rest in the cluster

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 6)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 26–30

26application · medium
A security auditor is reviewing a Kubernetes cluster that hosts multi-tenant workloads. The auditor wants to ensure that a container breakout in one tenant's pod does not expose other tenants' data or processes. Which set of controls should the administrator verify?
Select an answer first
27application · medium
Your organization wants to ensure that only images from approved registries and with no critical vulnerabilities are deployed. You have a policy engine (e.g., OPA/Gatekeeper) installed. Which policy should you implement?
Select an answer first
28application · medium
A security team wants to ensure that only images from their approved registry are used in the cluster. They also want to block images with critical vulnerabilities from being deployed. Which mechanism should they use?
Select an answer first
29application · medium
A company runs a Kubernetes cluster with multiple services that need to communicate securely. They want to ensure that each service has a unique identity and that traffic between services is encrypted. They also want to avoid managing certificates manually. Which solution should they implement?
Select an answer first
30foundation · easy
What is the primary function of runtime security monitoring in a container orchestration environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.