A macOS administrator must enable a security feature that prevents untrusted kernel extensions from loading, but the company uses a legacy device driver that is not notarized. What is the best approach?

Run the driver in a virtual machine to avoid the restriction.

Disable System Integrity Protection (SIP) to allow the driver to load.

Enable Secure Kernel Extension Loading and add the driver's team ID to the allowed list.

Use a third-party kernel extension manager to bypass the restriction.

A company wants to protect sensitive data on macOS devices. They are considering enabling FileVault and configuring the firewall. Which statement accurately describes the combined effect?

FileVault and the firewall both prevent unauthorized access to the device

FileVault and the firewall both encrypt network traffic

FileVault protects data at rest, and the firewall controls incoming network connections

FileVault and the firewall both protect against malware

A DevOps team runs a containerized application in Kubernetes. A developer needs to debug a running container, but the security team wants to minimize the attack surface. Which configuration should be applied to the pod's security context?

Set readOnlyRootFilesystem: false and runAsUser: 0

Set privileged: true and add CAP_SYS_ADMIN

Set allowPrivilegeEscalation: false and runAsNonRoot: true

Set hostPID: true and shareProcessNamespace: true

A Kubernetes cluster stores secrets in etcd. The security team wants to ensure that secrets are encrypted at rest and that access is restricted to specific service accounts. Which combination of controls is required?

Store secrets in a ConfigMap and rely on namespace isolation.

Enable encryption at rest for etcd and configure RBAC to limit secret access.

Enable TLS for all pod-to-API-server communication.

Use a NetworkPolicy to restrict access to the etcd port.

Which runtime security measure prevents a container process from gaining elevated privileges on the host?

Mounting the host filesystem as read-write

Using the default Docker seccomp profile

Dropping all capabilities and adding only required ones

Running the container with the --privileged flag

GIAC Security Essentials

Domain 4Objective 1

Container and MacOS Security GSEC Practice Questions (Page 4)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 16–20

16expert · hard
A macOS administrator must enable a security feature that prevents untrusted kernel extensions from loading, but the company uses a legacy device driver that is not notarized. What is the best approach?
Select an answer first
17expert · hard
A company wants to protect sensitive data on macOS devices. They are considering enabling FileVault and configuring the firewall. Which statement accurately describes the combined effect?
Select an answer first
18application · medium
A DevOps team runs a containerized application in Kubernetes. A developer needs to debug a running container, but the security team wants to minimize the attack surface. Which configuration should be applied to the pod's security context?
Select an answer first
19expert · hard
A Kubernetes cluster stores secrets in etcd. The security team wants to ensure that secrets are encrypted at rest and that access is restricted to specific service accounts. Which combination of controls is required?
Select an answer first
20foundation · easy
Which runtime security measure prevents a container process from gaining elevated privileges on the host?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.