A security team wants to mitigate supply chain risks by ensuring that images are built from trusted base images and have not been tampered with. What should they implement?

Set the `imagePullPolicy` to `Always`.

Use a NetworkPolicy to block traffic from untrusted registries.

Use image signing and verification, and scan images for vulnerabilities.

Store images in a private registry without any additional controls.

A pod runs a container that needs to write to a host directory. The container should run as a non-root user and have read-only root filesystem. What should be configured in the pod's security context?

Set `runAsNonRoot: true`, `readOnlyRootFilesystem: true`, and mount the host directory as a volume.

Set `privileged: true` and `runAsNonRoot: false`.

Set `allowPrivilegeEscalation: false` and `readOnlyRootFilesystem: false`.

Set `runAsUser: 0` and `readOnlyRootFilesystem: false`.

How does a pod use a custom service account to authenticate with the Kubernetes API?

By mounting a ConfigMap with API credentials.

By using a special image that includes the account credentials.

By setting the serviceAccountName field in the pod spec.

By setting an environment variable with the account token.

A team wants to ensure that all container images used in the cluster come from an approved private registry. What should they configure?

Create a NetworkPolicy that blocks traffic to unapproved registries.

Use an admission controller to validate that the image registry is in an allowed list.

Use a Secret to store the allowed registry names.

Set the `imagePullPolicy` to `IfNotPresent` in all pod specs.

Kubernetes and Cloud Native Associate (KCNA)

Domain 1Objective 4

Security KCNA Practice Questions (Page 2)

Part of the Kubernetes Fundamentals domain, which accounts for 44% of the KCNA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~15–26 in this domain), expect 3–4 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

44%of the exam

Questions 6–10

6application · medium
A security team wants to mitigate supply chain risks by ensuring that images are built from trusted base images and have not been tampered with. What should they implement?
Select an answer first
7foundation · easy
Which Pod Security Standard is the most restrictive and is recommended for the highest security?
Select an answer first
8application · medium
A pod runs a container that needs to write to a host directory. The container should run as a non-root user and have read-only root filesystem. What should be configured in the pod's security context?
Select an answer first
9foundation · easy
How does a pod use a custom service account to authenticate with the Kubernetes API?
Select an answer first
10application · medium
A team wants to ensure that all container images used in the cluster come from an approved private registry. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCNA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCNA” is a trademark of its owner, used for identification only.