A user downloads a signed application from the internet and tries to open it on macOS. Gatekeeper blocks it because the application is not notarized. What is the most likely reason for this block?

The application is unsigned and cannot be verified

The application is quarantined by XProtect

The application's code signature is valid but it has not been notarized by Apple

The application is from an unidentified developer

A development team uses a public base image that is known to have a critical vulnerability. The team needs to continue using the image because no patched alternative exists. Which strategy best reduces the risk while maintaining functionality?

Use the image as-is and rely on runtime detection to catch any attacks.

Disable the vulnerable component's functionality in the application code.

Rebuild the image from scratch using a different base that may not be compatible.

Apply a compensating control such as a NetworkPolicy that restricts the vulnerable component's network access, and monitor for exploitation attempts.

A macOS user needs to run an application that requires access to files outside its sandbox. The security team wants to minimize the risk of the app accessing sensitive data. What is the best approach?

Disable the sandbox for the application to allow full access.

Run the application in a virtual machine.

Use macOS App Sandbox with temporary exception entitlements for the specific files needed.

Grant the application Full Disk Access.

In Kubernetes, what is the primary purpose of Role-Based Access Control (RBAC)?

To limit the CPU and memory usage of pods

To automatically scale the number of pods based on load

To encrypt network traffic between pods

To control what actions users and service accounts can perform on cluster resources

GIAC Security Essentials

Domain 4Objective 1

Container and MacOS Security GSEC Practice Questions (Page 1)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 1–5

1application · medium
A user downloads a signed application from the internet and tries to open it on macOS. Gatekeeper blocks it because the application is not notarized. What is the most likely reason for this block?
Select an answer first
2expert · hard
A development team uses a public base image that is known to have a critical vulnerability. The team needs to continue using the image because no patched alternative exists. Which strategy best reduces the risk while maintaining functionality?
Select an answer first
3expert · hard
A macOS user needs to run an application that requires access to files outside its sandbox. The security team wants to minimize the risk of the app accessing sensitive data. What is the best approach?
Select an answer first
4foundation · easy
Which Linux kernel feature is primarily responsible for enforcing resource limits on a container, such as maximum CPU and memory usage?
Select an answer first
5foundation · easy
In Kubernetes, what is the primary purpose of Role-Based Access Control (RBAC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.