A user downloads a signed application from the internet and tries to open it. macOS Gatekeeper blocks the app because it is not from the App Store or an identified developer. The user needs to run this app for work. What is the most secure way to allow it?

Run the app from the Terminal using the 'open' command.

Disable Gatekeeper entirely in System Settings.

Move the app to the Applications folder and try again.

Right-click the app and select Open, then confirm in the dialog that appears.

A company is adopting containers and wants to ensure that only trusted images are used. They have a private registry and want to enforce image signing. Which approach is most effective?

Use a network policy to restrict access to the registry

Use a base image from a public registry

Use a Kubernetes admission controller to verify image signatures before deployment

Use a runtime security tool to monitor containers after deployment

A macOS user is a target of a phishing campaign that delivers a malicious application. The application is signed with a valid Apple Developer ID but is not notarized. What is the most likely outcome when the user tries to open it?

XProtect will quarantine the application

The application will run because it is signed

Gatekeeper will block the application because it is not notarized

SIP will prevent the application from running

A security team scans a container image and finds a critical vulnerability in a shared library used by the application. The library is not required at runtime. What is the most effective remediation?

Use a runtime security tool to monitor for exploitation attempts.

Run the container with a read-only root filesystem.

Remove the library from the image and rebuild it from a minimal base image.

Apply a network policy to block outbound traffic from the container.

Which practice is most effective in mitigating supply chain attacks on container images?

Using the latest tag for base images to ensure updates

Storing all images in a public registry for transparency

Scanning images for vulnerabilities only after deployment

Signing images and verifying signatures before deployment

GIAC Security Essentials

Domain 4Objective 1

Container and MacOS Security GSEC Practice Questions (Page 3)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 11–15

11application · medium
A user downloads a signed application from the internet and tries to open it. macOS Gatekeeper blocks the app because it is not from the App Store or an identified developer. The user needs to run this app for work. What is the most secure way to allow it?
Select an answer first
12expert · hard
A company is adopting containers and wants to ensure that only trusted images are used. They have a private registry and want to enforce image signing. Which approach is most effective?
Select an answer first
13expert · hard
A macOS user is a target of a phishing campaign that delivers a malicious application. The application is signed with a valid Apple Developer ID but is not notarized. What is the most likely outcome when the user tries to open it?
Select an answer first
14application · medium
A security team scans a container image and finds a critical vulnerability in a shared library used by the application. The library is not required at runtime. What is the most effective remediation?
Select an answer first
15foundation · easy
Which practice is most effective in mitigating supply chain attacks on container images?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.