A macOS user has a legitimate application that is being flagged by XProtect as malware. The application is critical for the user's work and is from a trusted vendor. What is the most appropriate action?

Remove the application and find an alternative

Reinstall macOS to clear the detection

Submit the application to Apple for review and whitelisting

Disable XProtect temporarily to run the application

A security team wants to ensure that only images from a trusted internal registry can be deployed in their Kubernetes cluster. Which control should they implement?

Network policy that blocks traffic to external registries.

Admission controller that validates image registry and rejects unapproved sources.

Image signing and verification at runtime.

RBAC that limits who can pull images.

A Kubernetes cluster runs a multi-tenant workload. The security team must prevent a compromised pod from communicating with pods in other namespaces, while still allowing it to reach the Kubernetes API server for health checks. Which set of controls best achieves this?

Define a NetworkPolicy that allows egress only to the API server's IP and denies all other egress, plus an ingress policy that denies all cross-namespace traffic.

Use RBAC to restrict the pod's service account to only read its own namespace.

Enable TLS for all pod-to-pod communication.

Run all pods with a read-only root filesystem.

What is a common mitigation strategy for a macOS device infected with malware?

Deleting all user files to ensure the malware is removed

Disabling System Integrity Protection to allow removal of malicious files

Turning off the Application Firewall to avoid interference

Running a malware scanner and removing detected threats

A security analyst is reviewing a container image used in production. The image was built from a base image that is several months old and includes a known critical vulnerability. The team wants to continue using the image but reduce risk. What is the most effective immediate action?

Add a runtime security agent to the container

Restrict the container's network access

Rebuild the image from an updated base image and re-scan it

Set the container to run as a non-root user

GIAC Security Essentials

Domain 4Objective 1

Container and MacOS Security GSEC Practice Questions (Page 6)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 26–30

26expert · hard
A macOS user has a legitimate application that is being flagged by XProtect as malware. The application is critical for the user's work and is from a trusted vendor. What is the most appropriate action?
Select an answer first
27application · medium
A security team wants to ensure that only images from a trusted internal registry can be deployed in their Kubernetes cluster. Which control should they implement?
Select an answer first
28expert · hard
A Kubernetes cluster runs a multi-tenant workload. The security team must prevent a compromised pod from communicating with pods in other namespaces, while still allowing it to reach the Kubernetes API server for health checks. Which set of controls best achieves this?
Select an answer first
29foundation · easy
What is a common mitigation strategy for a macOS device infected with malware?
Select an answer first
30application · medium
A security analyst is reviewing a container image used in production. The image was built from a base image that is several months old and includes a known critical vulnerability. The team wants to continue using the image but reduce risk. What is the most effective immediate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.