A containerized application needs to access a host device for legitimate functionality. The security team is concerned about the risk of container breakout. Which approach provides the necessary access while minimizing risk?

Mount the host filesystem into the container

Run the container in privileged mode

Use a device plugin or Kubernetes device plugin to expose the device with specific permissions

A company uses a private registry for container images. The security team wants to ensure that only approved, vulnerability-scanned images are deployed to production. Which combination of controls best achieves this?

Use an admission controller in Kubernetes to validate image signatures and scan results

Require developers to manually check images before deployment

Set the image pull policy to Always

Use a network policy to block access to the registry

A security analyst is explaining container isolation to a new team member. Which statement accurately describes how containers achieve isolation on a Linux host?

Containers use a hypervisor to virtualize hardware for each container

Containers rely on SELinux to isolate all system calls

Containers use namespaces to isolate process, network, and filesystem views, and cgroups to limit resource usage

Containers run in separate kernels to ensure isolation

A macOS device is infected with malware that has modified system files. The security team wants to restore the device to a known good state. Which approach is most effective?

Use a malware removal tool to delete the infected files

Reinstall macOS and restore from a backup taken before the infection

Disable SIP and manually repair the system files

Use Time Machine to restore the entire system

GIAC Security Essentials

Domain 4Objective 1

Container and MacOS Security GSEC Practice Questions (Page 8)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 36–40

36expert · hard
A containerized application needs to access a host device for legitimate functionality. The security team is concerned about the risk of container breakout. Which approach provides the necessary access while minimizing risk?
Select an answer first
37application · medium
A company uses a private registry for container images. The security team wants to ensure that only approved, vulnerability-scanned images are deployed to production. Which combination of controls best achieves this?
Select an answer first
38application · medium
A security analyst is explaining container isolation to a new team member. Which statement accurately describes how containers achieve isolation on a Linux host?
Select an answer first
39expert · hard
A macOS device is infected with malware that has modified system files. The security team wants to restore the device to a known good state. Which approach is most effective?
Select an answer first
40foundation · easy
Which Kubernetes resource is specifically designed to securely store sensitive data such as passwords and API keys?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.