Your organization runs a multi-tenant Kubernetes cluster where each team deploys workloads into shared namespaces. The security team wants to ensure that no workload can run with root privileges, escalate privileges, or mount host paths, while still allowing teams to deploy standard web applications. Which approach should you use?

Configure a NetworkPolicy that blocks all ingress traffic to pods

Enable Kubernetes audit logging for all pod creation events

Apply a Pod Security Admission (PSA) restricted profile to all namespaces

Set a ResourceQuota that limits CPU and memory per namespace

A Kubernetes cluster runs multiple teams in shared namespaces. One team's workload is consuming excessive memory, causing other pods to be evicted. The cluster administrator wants to prevent this without affecting the other teams' workloads. What should be configured?

Set a PriorityClass on the other teams' workloads to preempt the offending workload.

Set a NetworkPolicy to block traffic from the offending namespace.

Set a ResourceQuota on the offending namespace with a memory limit, and set memory limits on the workloads.

Set a LimitRange on the offending namespace with default memory limits.

In Kubernetes, what is the default behavior for network traffic between pods if no NetworkPolicy is defined?

Only traffic to the API server is allowed

Only traffic within the same namespace is allowed

What is the purpose of scanning container images for vulnerabilities?

To verify the image was built by a trusted CI/CD pipeline

To ensure the image runs on the correct operating system

To identify known security issues in the image's software packages

To optimize the image size for faster deployment

A development team needs to deploy a microservice that reads a database password and calls an internal API using a service account token. The cluster uses Kubernetes RBAC and the team wants to avoid hardcoding credentials in the container image. Which approach should you recommend?

Create a Kubernetes ServiceAccount and bind it to the database password

Embed the password in the container image environment variables

Store the password in a Kubernetes Secret and mount it as a volume; use the pod's service account for API calls

Use a ConfigMap to store the password and reference it in the deployment

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 8)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 36–40

36application · medium
Your organization runs a multi-tenant Kubernetes cluster where each team deploys workloads into shared namespaces. The security team wants to ensure that no workload can run with root privileges, escalate privileges, or mount host paths, while still allowing teams to deploy standard web applications. Which approach should you use?
Select an answer first
37application · medium
A Kubernetes cluster runs multiple teams in shared namespaces. One team's workload is consuming excessive memory, causing other pods to be evicted. The cluster administrator wants to prevent this without affecting the other teams' workloads. What should be configured?
Select an answer first
38foundation · easy
In Kubernetes, what is the default behavior for network traffic between pods if no NetworkPolicy is defined?
Select an answer first
39foundation · easy
What is the purpose of scanning container images for vulnerabilities?
Select an answer first
40application · medium
A development team needs to deploy a microservice that reads a database password and calls an internal API using a service account token. The cluster uses Kubernetes RBAC and the team wants to avoid hardcoding credentials in the container image. Which approach should you recommend?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.