What does 'provenance' mean in the context of software supply chain security?

The license type of the artifact

The documented history of an artifact's origin and how it was built

The number of times an artifact has been scanned

The speed at which an artifact is downloaded

A developer is creating a Dockerfile for a web application. Which practice is most effective for reducing the attack surface of the resulting image?

Include debugging tools in the image to help troubleshoot production issues.

Copy the entire application source code into the image for easier updates.

Run the container as root to simplify permission management.

Use a minimal base image and install only the packages required by the application.

A security auditor recommends implementing least privilege access for the artifact repository. Which action aligns with this recommendation?

Grant all users full administrative rights to simplify management.

Disable access control and rely on the network firewall.

Use a single shared account for all developers.

Grant each user the minimum permissions required for their role.

A security team is reviewing container images for potential threats. Which of the following is a common threat specifically associated with container images?

Storing images in a private repository.

Running the container as a non-root user.

Inclusion of unnecessary packages that increase the attack surface.

Using a minimal base image that reduces functionality.

An organization wants to ensure that only images signed by their CI/CD pipeline can be deployed in their production cluster. What should they configure?

Use a private repository and restrict access to the cluster's pull credentials.

Enable image signature verification in the cluster's admission controller and configure the pipeline to sign images.

Store images in a registry that supports content trust and enable it for all users.

Set the imagePullPolicy to Always in the deployment manifests.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 1Objective 5

Artifact Repository and Image Security KCSA Practice Questions (Page 4)

Part of the Overview of Cloud Native Security domain, which accounts for 14% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

14%of the exam

Questions 16–20

16foundation · easy
What does 'provenance' mean in the context of software supply chain security?
Select an answer first
17application · medium
A developer is creating a Dockerfile for a web application. Which practice is most effective for reducing the attack surface of the resulting image?
Select an answer first
18application · medium
A security auditor recommends implementing least privilege access for the artifact repository. Which action aligns with this recommendation?
Select an answer first
19application · medium
A security team is reviewing container images for potential threats. Which of the following is a common threat specifically associated with container images?
Select an answer first
20application · medium
An organization wants to ensure that only images signed by their CI/CD pipeline can be deployed in their production cluster. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.