Which base image characteristic is most important for reducing the attack surface of a container image?

The image contains only the necessary runtime components

The image has a large number of layers

The image is based on a popular distribution

The image includes a package manager for easy updates

What is the main benefit of pinning a base image to a specific digest (e.g., ubuntu@sha256:...)?

It guarantees the exact same image content is used for every build

It allows the use of any tag without affecting the build

It automatically updates the image with security patches

You are reviewing a Dockerfile for a Python web application. The current image is based on 'python:3.9-slim' and includes a RUN step that installs 'curl', 'vim', and 'git' for debugging purposes. You need to reduce the attack surface and image size. What is the most effective change?

Keep the debugging tools but run the container as a non-root user.

Use the full 'python:3.9' image instead of the slim variant to have more control over the installed packages.

Keep the debugging tools but install them in a separate layer so they can be removed later.

Remove the installation of curl, vim, and git from the Dockerfile, and use a multi-stage build to copy only the Python application and its runtime dependencies.

Your team maintains a set of base images for internal microservices. A recent CVE scan revealed that the current base image has a known vulnerability in a library that is not used by any of your services. You need to establish a process to keep the base images secure without breaking existing services. What is the most appropriate approach?

Immediately update all services to use the latest base image tag as soon as a CVE is announced.

Set up a scheduled job that scans the base images for vulnerabilities, and when a fix is available, build and test a new base image version before promoting it.

Switch all services to a completely different base image that has no known CVEs.

Ignore the vulnerability because the library is not used by any service.

A developer is creating a Dockerfile for a Python application. To minimize the runtime footprint, which dependencies should be included in the final image?

A package manager and shell for debugging

The full Python standard library and all optional modules

Only the Python packages required to run the application

All packages that were used during development

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 1

Minimize Base Image Footprint CKS Practice Questions (Page 2)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

20%of the exam

Questions 6–10

6foundation · easy
Which base image characteristic is most important for reducing the attack surface of a container image?
Select an answer first
7foundation · easy
What is the main benefit of pinning a base image to a specific digest (e.g., ubuntu@sha256:...)?
Select an answer first
8application · medium
You are reviewing a Dockerfile for a Python web application. The current image is based on 'python:3.9-slim' and includes a RUN step that installs 'curl', 'vim', and 'git' for debugging purposes. You need to reduce the attack surface and image size. What is the most effective change?
Select an answer first
9application · medium
Your team maintains a set of base images for internal microservices. A recent CVE scan revealed that the current base image has a known vulnerability in a library that is not used by any of your services. You need to establish a process to keep the base images secure without breaking existing services. What is the most appropriate approach?
Select an answer first
10foundation · easy
A developer is creating a Dockerfile for a Python application. To minimize the runtime footprint, which dependencies should be included in the final image?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.