Which of the following is an example of an unnecessary runtime dependency that should be excluded from a production container image?

The application's configuration files

The application's compiled binary

Your CI pipeline builds a container image from a base image tagged 'latest'. A vulnerability scan of the built image reports a critical CVE in a system library. The scan also shows that the same CVE is present in the base image itself. You need to prevent this issue from recurring. What should you do?

Continue using the 'latest' tag but run the vulnerability scan only on the final built image.

Pin the base image to a specific digest and update it regularly after scanning the new base image for vulnerabilities.

Switch to a different base image without scanning it, assuming it is more secure.

Add a RUN step in the Dockerfile to update all packages to the latest version before building the application.

Why is it important to regularly update base images in containerized applications?

To remove the need for image scanning

To change the application's behavior

To include security patches for known vulnerabilities

Which action directly reduces the size of a container image?

Removing unnecessary packages and cleaning package caches in the Dockerfile

Adding more RUN instructions to install additional tools

Copying the entire source code into the image

Using a base image with many preinstalled utilities

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 1

Minimize Base Image Footprint CKS Practice Questions (Page 4)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

20%of the exam

Questions 16–20

16foundation · easy
Which of the following is an example of an unnecessary runtime dependency that should be excluded from a production container image?
Select an answer first
17foundation · easy
A security team wants to identify known vulnerabilities in the base images and dependencies used by their containerized applications. Which tool category is designed for this purpose?
Select an answer first
18application · medium
Your CI pipeline builds a container image from a base image tagged 'latest'. A vulnerability scan of the built image reports a critical CVE in a system library. The scan also shows that the same CVE is present in the base image itself. You need to prevent this issue from recurring. What should you do?
Select an answer first
19foundation · easy
Why is it important to regularly update base images in containerized applications?
Select an answer first
20foundation · easy
Which action directly reduces the size of a container image?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Minimize Base Image Footprint CKS Practice Questions (Page 4)

Questions 16–20

Which of the following is an example of an unnecessary runtime dependency that should be excluded from a production container image?

A security team wants to identify known vulnerabilities in the base images and dependencies used by their containerized applications. Which tool category is designed for this purpose?

Why is it important to regularly update base images in containerized applications?

Which action directly reduces the size of a container image?

Keep studying — Minimize Microservice Vulnerabilities