How does a cluster establish trust in a container image using signatures?

By verifying the image's signature against a trusted public key before allowing it to run

By ensuring the image is stored in a private repository

By checking the image's size and layer count

By comparing the image's SHA-256 hash with the registry's metadata

A security team wants to ensure that every container image deployed in production can be traced back to the exact source code and build process that produced it. Which practice should they adopt?

Keep a log of all images pushed to the repository in a spreadsheet.

Tag each image with the git commit hash and rely on the tag for traceability.

Generate and store a signed provenance attestation for each image during the CI/CD build.

Store the Dockerfile in a shared drive for each image.

A company wants to ensure that only images signed by their release engineering team can be pulled from their artifact repository. What should they implement?

Set the repository to read-only for all users except the release team.

Encrypt the repository data at rest to protect against tampering.

Configure the repository to verify signatures before allowing pull requests.

Use a private network for the repository to prevent external access.

Which of the following is a common security threat associated with container images?

Inclusion of software with known vulnerabilities in base images

Using a container runtime that supports namespaces

Applying resource limits to containers

Storing images in a private repository

A company has multiple teams sharing an artifact repository. They need to ensure that the 'release' repository is immutable and only the release team can push to it. However, they also need to allow other teams to pull images for testing. What should they configure?

Give all teams write access to the 'release' repository to facilitate testing.

Set the 'release' repository to read-only for all teams except the release team, and enable immutability.

Use a shared credential for all teams to access the repository.

Create a separate repository for testing and copy images there manually.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 1Objective 5

Artifact Repository and Image Security KCSA Practice Questions (Page 3)

Part of the Overview of Cloud Native Security domain, which accounts for 14% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

14%of the exam

Questions 11–15

11foundation · easy
How does a cluster establish trust in a container image using signatures?
Select an answer first
12application · medium
A security team wants to ensure that every container image deployed in production can be traced back to the exact source code and build process that produced it. Which practice should they adopt?
Select an answer first
13application · medium
A company wants to ensure that only images signed by their release engineering team can be pulled from their artifact repository. What should they implement?
Select an answer first
14foundation · easy
Which of the following is a common security threat associated with container images?
Select an answer first
15expert · medium
A company has multiple teams sharing an artifact repository. They need to ensure that the 'release' repository is immutable and only the release team can push to it. However, they also need to allow other teams to pull images for testing. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.