Minimize Base Image Footprint CKS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which process best supports keeping container images secure over time?

   • AOnly updating images when a vulnerability is publicly disclosed
   • BEstablishing a regular schedule to update base images and rebuild containers
   • CUsing the same base image forever to avoid changes
   • DRelying solely on runtime security tools
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   Your CI pipeline scans all images for vulnerabilities. A scan of a new image built from 'alpine:3.14' reports a critical CVE in the 'musl' library. The CVE is not present in 'alpine:3.15'. Your application is a static Go binary that does not use musl. You need to decide whether to update the base image. What is the best course of action?

   • AKeep using 'alpine:3.14' because the application does not use musl, and the CVE is not exploitable.
   • BAdd a RUN step to remove the musl library from the alpine:3.14 image.
   • CSwitch to a distroless image to eliminate the musl library entirely.
   • DUpdate the base image to 'alpine:3.15' to eliminate the CVE, even though the application does not use musl.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A developer wants to ensure that a container image build is reproducible and does not unexpectedly change when the base image is updated. Which practice is most effective?

   • AUsing a floating tag like 'stable'
   • BRebuilding the image every time without specifying a version
   • CPinning the base image to a specific version tag or digest
   • DUsing the latest tag for the base image
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   Your organization has a policy that all images must be reproducible and that security updates must be applied within 7 days of a CVE being published. You currently use 'FROM node:16-alpine' in your Dockerfile. A critical CVE is published for a library in the alpine base image. You need to update the base image while maintaining reproducibility. What is the best approach?

   • AUse 'FROM node:16-alpine' and add a RUN step to update the package manager and install the patched library.
   • BUpdate the Dockerfile to use 'FROM node:16-alpine@sha256:<new-digest>' after verifying that the new digest contains the fix, and test the application before deploying.
   • CChange the Dockerfile to use 'FROM node:16-alpine' and rely on the registry to update the tag automatically.
   • DSwitch to a completely different base image that does not have the CVE, even if it is larger.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A developer is selecting a base image for a containerized application that runs a compiled Go binary. The goal is to minimize the attack surface and image footprint. Which base image choice best meets this goal?

   • Aubuntu:latest
   • Bcentos:7
   • Cnode:16
   • Ddistroless
   Reveal Solution Discussion Select an answer first