Artifact Repository and Image Security KCSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A developer is creating a Dockerfile for a Node.js application. They want to ensure the image is as secure as possible. Which of the following practices is most important?

   • ACopy the entire project directory into the image, including node_modules.
   • BSet the working directory to / and run all commands as root for simplicity.
   • CUse the latest version of Node.js and install all npm packages globally.
   • DRun the container as a non-root user and use a minimal base image.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A DevOps team uses a private artifact repository to store container images. They want to automatically block any image that contains a known critical vulnerability from being deployed. Which approach should they implement?

   • AConfigure the repository to scan images on push and enforce a policy that prevents pull if a critical vulnerability is found.
   • BRestrict access to the repository to only senior engineers who are trusted to push images.
   • CUse a base image that is known to be secure and assume all images built from it are safe.
   • DRun a vulnerability scan manually before each deployment and document the results in a ticket.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How do image scanning tools typically detect vulnerabilities in container images?

   • ABy analyzing the Dockerfile for syntax errors
   • BBy comparing installed package versions against known vulnerability databases
   • CBy executing the image and observing its runtime behavior
   • DBy checking the image's digital signature only
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A company uses a private registry and wants to ensure that only images signed by their CI system can be deployed. They also want to allow developers to pull images for local testing without restrictions. What is the best way to achieve this?

   • AUse a separate registry for production images and restrict access to it.
   • BManually verify signatures on each production deployment.
   • CEnforce signature verification in the production cluster using an admission controller, while leaving the registry open for developers.
   • DRequire the registry to verify signatures before allowing any pull.
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A company wants to reduce the number of vulnerabilities in their container images. They have a large number of existing images and a limited budget. Which strategy is most effective?

   • AUse a public registry that promises to scan images for free.
   • BSwitch to a different container runtime that is more secure.
   • CPurchase a commercial scanner that can fix vulnerabilities automatically.
   • DImplement a policy to rebuild images from minimal base images and regularly scan and update dependencies.
   Reveal Solution Discussion Select an answer first