Your CI/CD pipeline builds container images and pushes them to a private registry. The security team requires that only images that have passed vulnerability scanning and have a valid signature can be deployed to the production cluster. Which combination of controls should you implement?

Set imagePullPolicy to Always on all deployments

Scan images in the pipeline, sign them with a private key, and configure an admission controller to verify the signature and scan results

Enable Kubernetes audit logging for image pulls

Use a private registry and restrict access with RBAC

You are designing a multi-tenant Kubernetes cluster where tenants require strong isolation. You have two options: (1) use namespaces with NetworkPolicies and Pod Security Admission, or (2) use separate clusters for each tenant. The organization has a limited budget and wants to minimize operational overhead. Which approach should you choose?

Use namespaces with NetworkPolicies and Pod Security Admission to balance isolation and cost

Use separate clusters for each tenant to provide stronger isolation, accepting higher operational overhead

Use namespaces with ResourceQuotas only

Use a single cluster with no isolation controls to minimize cost

Which of the following is a common enforcement mechanism used by runtime security tools for container workloads?

Killing or blocking malicious processes

Changing the pod's network policy

A company is migrating a legacy application to Kubernetes. The application requires a database password and a client certificate to connect to an external service. The security team mandates that secrets must not be stored in etcd and must be rotated without restarting the application. Which solution meets all requirements?

Use a ServiceAccount token as the database password and mount the certificate from the image.

Store secrets in a ConfigMap and use environment variables.

Use an external secrets manager (e.g., HashiCorp Vault) with a CSI driver that mounts secrets as volumes.

Store secrets in Kubernetes Secrets and mount them as volumes.

What is the primary purpose of signing container images?

To verify the integrity and origin of the image

To scan the image for vulnerabilities

To compress the image for faster transfer

To encrypt the image so only authorized users can pull it

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 7)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 31–35

31application · medium
Your CI/CD pipeline builds container images and pushes them to a private registry. The security team requires that only images that have passed vulnerability scanning and have a valid signature can be deployed to the production cluster. Which combination of controls should you implement?
Select an answer first
32expert · hard
You are designing a multi-tenant Kubernetes cluster where tenants require strong isolation. You have two options: (1) use namespaces with NetworkPolicies and Pod Security Admission, or (2) use separate clusters for each tenant. The organization has a limited budget and wants to minimize operational overhead. Which approach should you choose?
Select an answer first
33foundation · easy
Which of the following is a common enforcement mechanism used by runtime security tools for container workloads?
Select an answer first
34expert · hard
A company is migrating a legacy application to Kubernetes. The application requires a database password and a client certificate to connect to an external service. The security team mandates that secrets must not be stored in etcd and must be rotated without restarting the application. Which solution meets all requirements?
Select an answer first
35foundation · easy
What is the primary purpose of signing container images?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Workload Security in Container Orchestration GCSA Practice Questions (Page 7)

Questions 31–35

Your CI/CD pipeline builds container images and pushes them to a private registry. The security team requires that only images that have passed vulnerability scanning and have a valid signature can be deployed to the production cluster. Which combination of controls should you implement?

Which of the following is a common enforcement mechanism used by runtime security tools for container workloads?

What is the primary purpose of signing container images?

Keep studying — Container Orchestration Architecture and Security