A company wants to ensure that the container images used in production are built from verified source code and have not been tampered with. Which combination of practices should they implement?

Use a private repository and restrict access to the build server.

Use signed commits, build images in a controlled CI/CD environment, and sign the resulting images.

Use a base image from a trusted vendor and assume it is secure.

Scan images for vulnerabilities and fix any that are found.

A company uses a public container registry for some images and a private registry for others. They want to enforce that only images signed by their internal CI system are used in production. What is the most effective approach?

Only use images from the private registry and ignore the public ones.

Manually verify the signature of each image before deployment.

Use an admission controller in the cluster that verifies signatures for all images, regardless of registry.

Configure the public registry to require signatures for all images.

Where in a CI/CD pipeline should image scanning be integrated to prevent vulnerable images from being deployed?

Before the image is pushed to the registry and before deployment

Only when a security incident is reported

Only after the image has been running in production for a week

Only in the developer's local environment

Which strategy helps ensure the integrity of artifacts throughout the software supply chain?

Relying solely on the artifact's file name to confirm its contents

Verifying checksums or signatures of artifacts at each stage of the pipeline

Storing artifacts in a public repository for transparency

Using the latest version of every dependency without review

What is a risk of using an image from an untrusted public repository?

The image may contain malicious code or backdoors

The image will automatically be scanned by the cluster

The image will always be slower to pull

The image will not run on Kubernetes

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 1Objective 5

Artifact Repository and Image Security KCSA Practice Questions (Page 6)

Part of the Overview of Cloud Native Security domain, which accounts for 14% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

14%of the exam

Questions 26–30

26application · medium
A company wants to ensure that the container images used in production are built from verified source code and have not been tampered with. Which combination of practices should they implement?
Select an answer first
27expert · medium
A company uses a public container registry for some images and a private registry for others. They want to enforce that only images signed by their internal CI system are used in production. What is the most effective approach?
Select an answer first
28foundation · easy
Where in a CI/CD pipeline should image scanning be integrated to prevent vulnerable images from being deployed?
Select an answer first
29foundation · easy
Which strategy helps ensure the integrity of artifacts throughout the software supply chain?
Select an answer first
30foundation · easy
What is a risk of using an image from an untrusted public repository?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.