A team is building a container image for a legacy application that requires several system libraries. They want to minimize the attack surface while keeping the application functional. What is the best approach?

Use a base image from the internet without verifying its source.

Start from a minimal base image and add only the required libraries, then scan the image for vulnerabilities.

Use a minimal base image and install all libraries, including optional ones, to ensure compatibility.

Use a full-featured base image that already includes all libraries and skip scanning.

A developer is building a container image for a Python application. They need to ensure that no secrets are embedded in the image. Which practice should they follow?

Copy the secrets file into the image and delete it after the build.

Use environment variables or secret management tools to inject secrets at runtime.

Hardcode the secrets in the Dockerfile using ENV instructions.

Store secrets in a text file in the same directory as the Dockerfile.

What is a key benefit of enforcing access control on an artifact repository?

It prevents unauthorized users from pushing or pulling images, reducing the risk of tampering

It eliminates the need for image signing

It automatically scans images for vulnerabilities

It speeds up image distribution across clusters

What is a secure way to handle secrets (e.g., API keys) for a containerized application?

Embed them in the application's source code

Hardcode them in the Dockerfile as environment variables

Store them in a text file inside the image

Inject them at runtime using Kubernetes Secrets or a secrets management tool

Which practice is a recommended way to minimize the attack surface of a container image?

Using a minimal base image that contains only necessary components

Including a full operating system with all default tools

Running the container as the root user

Storing secrets in environment variables within the image

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 1Objective 5

Artifact Repository and Image Security KCSA Practice Questions (Page 1)

Part of the Overview of Cloud Native Security domain, which accounts for 14% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

14%of the exam

Questions 1–5

1expert · medium
A team is building a container image for a legacy application that requires several system libraries. They want to minimize the attack surface while keeping the application functional. What is the best approach?
Select an answer first
2application · medium
A developer is building a container image for a Python application. They need to ensure that no secrets are embedded in the image. Which practice should they follow?
Select an answer first
3foundation · easy
What is a key benefit of enforcing access control on an artifact repository?
Select an answer first
4foundation · easy
What is a secure way to handle secrets (e.g., API keys) for a containerized application?
Select an answer first
5foundation · easy
Which practice is a recommended way to minimize the attack surface of a container image?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.