A developer wants to reduce the number of layers in a container image. Which Dockerfile practice is most effective for this?

Adding a new FROM instruction for each dependency

Copying files one by one with multiple COPY instructions

Using a separate RUN instruction for each command

Combining multiple RUN commands into a single RUN instruction

Why do distroless images reduce the attack surface compared to standard base images?

They include more security patches

They are always smaller than any other image

They eliminate package managers and shells

What is the primary purpose of scanning a container image for vulnerabilities?

To determine the image's size and layer count

To identify known security issues in the image's components

To measure the image's runtime performance

To verify the image's provenance and authorship

Your organization requires that all container images be reproducible. A developer has been using 'FROM node:14' in the Dockerfile, and a recent build pulled a newer version of the image that introduced a breaking change. You need to ensure that the exact same base image is used every time while still allowing for planned security updates. What should you do?

Pin the base image to a specific digest (e.g., node:14@sha256:...) and update the digest manually after reviewing and testing the new image.

Copy the base image into your private registry and use the 'latest' tag from there.

Use 'FROM node:14.0.0' and rely on the patch version to remain unchanged.

Use 'FROM node:latest' and lock the image in the container registry.

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 1

Minimize Base Image Footprint CKS Practice Questions (Page 3)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

20%of the exam

Questions 11–15

11foundation · easy
A developer wants to reduce the number of layers in a container image. Which Dockerfile practice is most effective for this?
Select an answer first
12foundation · easy
Why do distroless images reduce the attack surface compared to standard base images?
Select an answer first
13foundation · easy
What is the primary purpose of scanning a container image for vulnerabilities?
Select an answer first
14application · medium
Your organization requires that all container images be reproducible. A developer has been using 'FROM node:14' in the Dockerfile, and a recent build pulled a newer version of the image that introduced a breaking change. You need to ensure that the exact same base image is used every time while still allowing for planned security updates. What should you do?
Select an answer first
15foundation · easy
Which Dockerfile instruction is known to create a new image layer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Minimize Base Image Footprint CKS Practice Questions (Page 3)

Questions 11–15

A developer wants to reduce the number of layers in a container image. Which Dockerfile practice is most effective for this?

Why do distroless images reduce the attack surface compared to standard base images?

What is the primary purpose of scanning a container image for vulnerabilities?

Which Dockerfile instruction is known to create a new image layer?

Keep studying — Minimize Microservice Vulnerabilities