Image Repository KCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   Your organization uses a private container registry for all production images. Developers need to push images, but only the CI/CD pipeline should be able to deploy to production. You must ensure that developers cannot modify or overwrite production tags. What should you implement?

   • AConfigure the registry to require multi-factor authentication for all push operations.
   • BUse image signing to require that all images have a valid signature before they can be pulled.
   • CEnable vulnerability scanning on the production repository to block pushes with critical vulnerabilities.
   • DUse RBAC to grant developers push access only to a staging repository, and grant the CI/CD service account push access to the production repository.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   Your cluster uses a policy engine to require that all images are signed by a trusted key. A developer reports that a new image cannot be deployed, and the error indicates a signature verification failure. What is the most likely cause?

   • AThe registry is not configured for encryption at rest.
   • BThe image was not signed with the trusted private key during the build process.
   • CThe developer does not have RBAC permissions to pull the image.
   • DThe image has a critical vulnerability that was detected by the scanner.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of image signing?

   • ATo compress the image to reduce storage costs
   • BTo scan the image for known vulnerabilities
   • CTo prove the identity of the publisher and ensure the image has not been tampered with
   • DTo encrypt the image so that only authorized users can pull it
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Your organization has a shared registry with multiple namespaces. The security team wants to ensure that developers can only push images to their own team's namespace and cannot pull images from other teams' namespaces. What should you implement?

   • AMake all namespaces public and rely on the registry's firewall.
   • BUse RBAC to grant each team push and pull permissions only on their own namespace.
   • CUse image signing to verify that images are from the correct team.
   • DUse a single shared namespace and rely on the CI/CD pipeline to enforce team separation.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your security team wants to ensure that only images signed by your organization's private key can be deployed in the cluster. You have configured the container runtime to verify signatures. What additional step is required to make this effective?

   • ASign all images during the CI/CD pipeline using the private key.
   • BUse RBAC to restrict which users can pull images from the registry.
   • CStore the public key in a Kubernetes secret and mount it into all pods.
   • DEnable image scanning to ensure images are free of vulnerabilities.
   Reveal Solution Discussion Select an answer first