Artifact Repository and Image Security KCSA Practice Questions (Page 7)

Questions 31–34

1. 31expert · medium

   A security team wants to ensure that all container images in production have a complete and verifiable chain of custody from source code to deployment. They also want to automatically block any image that fails verification. Which approach should they implement?

   • AGenerate signed provenance attestations during the build, store them in the registry, and use an admission controller to verify them before deployment.
   • BUse a private repository and restrict access to the CI/CD system.
   • CUse a trusted base image and assume the final image is secure.
   • DScan images for vulnerabilities and require a clean scan before deployment.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of image signing?

   • ATo speed up image pulls from the registry
   • BTo encrypt the image so only authorized users can pull it
   • CTo automatically fix vulnerabilities in the image
   • DTo verify the authenticity and integrity of a container image
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company uses a shared artifact repository for multiple teams. They need to ensure that only the platform team can modify images in the 'production' repository, while other teams can only read from it. What should they implement?

   • AGive all teams write access to the repository to avoid delays in deployments.
   • BUse a single shared credential for all teams to simplify access management.
   • CMove the production images to a separate registry and share the credentials with all teams.
   • DCreate a repository policy that grants write access to the platform team and read-only access to other teams.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst discovers that a container image used in production contains a package with a known critical vulnerability. What is the most immediate risk to the organization?

   • AThe vulnerability will be patched automatically by the container runtime.
   • BThe image will fail to start due to the vulnerability.
   • CThe image will automatically be deleted from the repository.
   • DAn attacker could exploit the vulnerability to gain unauthorized access to the container or host.
   Reveal Solution Discussion Select an answer first