A containerized application requires access to a specific host device for hardware acceleration, but the security team wants to minimize the risk of a container breakout. Which approach best balances functionality and security?

Mount the host's /dev directory into the container.

Run the container with --privileged to ensure the device is accessible.

Use a user namespace to remap the container's root user.

Use the device plugin mechanism in Kubernetes to expose the device to the container with specific permissions.

A macOS administrator needs to allow a specific unsigned application to run on a user's machine, but must not weaken Gatekeeper for other applications. Which approach is most appropriate?

Sign the application with a self-signed certificate and add it to the keychain.

Move the application to /Applications and change its permissions.

Use the spctl command to add a custom rule that allows the specific application.

Disable Gatekeeper temporarily, run the app, then re-enable it.

What is the primary purpose of scanning container images for vulnerabilities?

To identify known security issues in the image's software components

To measure the performance of the container at runtime

To verify that the image was built from a trusted base image

To ensure the image is compatible with all container runtimes

A containerized application is experiencing memory exhaustion, causing the host to become unstable. The operations team wants to prevent a single container from consuming all host memory. What should be configured?

Set a memory limit in the container's cgroup configuration

Run the container with a read-only root filesystem

Set the container's CPU shares to a low value

Use a network policy to restrict outbound traffic

GIAC Security Essentials

Domain 4Objective 1

Container and MacOS Security GSEC Practice Questions (Page 5)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 21–25

21expert · hard
A containerized application requires access to a specific host device for hardware acceleration, but the security team wants to minimize the risk of a container breakout. Which approach best balances functionality and security?
Select an answer first
22application · easy
A company wants to prevent users from running unapproved applications on their Macs. Which macOS feature should be configured?
Select an answer first
23expert · hard
A macOS administrator needs to allow a specific unsigned application to run on a user's machine, but must not weaken Gatekeeper for other applications. Which approach is most appropriate?
Select an answer first
24foundation · easy
What is the primary purpose of scanning container images for vulnerabilities?
Select an answer first
25application · medium
A containerized application is experiencing memory exhaustion, causing the host to become unstable. The operations team wants to prevent a single container from consuming all host memory. What should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.