A microservice needs to access the Kubernetes API to list pods in its namespace. You want to grant the least privilege necessary. Which configuration should you use?

Create a dedicated ServiceAccount, bind it to a Role that allows list pods in the namespace, and configure the pod to use that ServiceAccount

Use the default ServiceAccount and bind a ClusterRole that allows list pods across all namespaces

Enable anonymous access to the Kubernetes API for the pod's IP

Store a Kubernetes API token in a Secret and mount it into the pod

A security operations team is investigating a potential container compromise. The runtime security tool has alerted on a process executing a binary that is not in the image's layer history. The image was scanned and signed at build time. Which action should the team take first?

Update the Pod Security Admission profile to restricted and redeploy.

Isolate the pod by applying a NetworkPolicy that denies all traffic, then capture a forensic snapshot of the container filesystem and memory.

Delete the pod immediately to stop the malicious process.

Re-scan the image with a different scanner to confirm the vulnerability.

A company uses a private container registry and wants to ensure that only signed, vulnerability-free images are deployed to production. They have a CI pipeline that builds and scans images. What additional control should be added to enforce this at deployment time?

Use a RuntimeClass that runs containers with seccomp profiles.

Use a Kubernetes NetworkPolicy to block traffic from the registry.

Configure an admission controller (e.g., Connaisseur or Portieris) to verify image signatures and reject unsigned images.

Set the imagePullPolicy to Always on all deployments.

GIAC Cloud Security Automation

Domain 3Objective 4

Workload Security in Container Orchestration GCSA Practice Questions (Page 9)

Part of the Container Orchestration Architecture and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 41–43

41application · medium
A microservice needs to access the Kubernetes API to list pods in its namespace. You want to grant the least privilege necessary. Which configuration should you use?
Select an answer first
42expert · hard
A security operations team is investigating a potential container compromise. The runtime security tool has alerted on a process executing a binary that is not in the image's layer history. The image was scanned and signed at build time. Which action should the team take first?
Select an answer first
43application · medium
A company uses a private container registry and wants to ensure that only signed, vulnerability-free images are deployed to production. They have a CI pipeline that builds and scans images. What additional control should be added to enforce this at deployment time?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Workload Security in Container Orchestration GCSA Practice Questions (Page 9)

Questions 41–43

A microservice needs to access the Kubernetes API to list pods in its namespace. You want to grant the least privilege necessary. Which configuration should you use?

A security operations team is investigating a potential container compromise. The runtime security tool has alerted on a process executing a binary that is not in the image's layer history. The image was scanned and signed at build time. Which action should the team take first?

A company uses a private container registry and wants to ensure that only signed, vulnerability-free images are deployed to production. They have a CI pipeline that builds and scans images. What additional control should be added to enforce this at deployment time?

Keep studying — Container Orchestration Architecture and Security