Your organization stores container images in a cloud-based registry. Compliance requirements mandate that images must be encrypted at rest and that only specific service accounts can access them. What should you configure?

Enable encryption at rest on the registry and use IAM roles to restrict access to the registry.

Enable vulnerability scanning on the registry.

Move images to a private registry on-premises.

Use image signing to ensure images are authentic.

Your CI/CD pipeline builds images and pushes them to a registry. You want to automatically prevent images with high-severity vulnerabilities from being deployed. What is the most effective approach?

Restrict access to the registry using RBAC.

Manually review images after deployment and roll back if issues are found.

Use image signing to ensure images are authentic.

Integrate a vulnerability scanner into the CI/CD pipeline and fail the build if critical vulnerabilities are found.

Your security team is auditing the image repository. They want to ensure that only authenticated users can pull images and that the images have not been altered since they were pushed. Which two mechanisms should be in place?

Vulnerability scanning and RBAC.

Authentication for the registry and image signing with verification.

Multi-factor authentication and audit logging.

Encryption at rest and network policies.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 2

Image Repository KCSA Practice Questions (Page 3)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

16%of the exam

Questions 11–15

11foundation · easy
Which authentication method is commonly used to secure access to a container image repository?
Select an answer first
12application · medium
Your organization stores container images in a cloud-based registry. Compliance requirements mandate that images must be encrypted at rest and that only specific service accounts can access them. What should you configure?
Select an answer first
13application · medium
Your CI/CD pipeline builds images and pushes them to a registry. You want to automatically prevent images with high-severity vulnerabilities from being deployed. What is the most effective approach?
Select an answer first
14foundation · easy
Which mechanism is used to verify that a signed container image has not been altered since it was signed?
Select an answer first
15application · medium
Your security team is auditing the image repository. They want to ensure that only authenticated users can pull images and that the images have not been altered since they were pushed. Which two mechanisms should be in place?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Image Repository KCSA Practice Questions (Page 3)

Questions 11–15

Which authentication method is commonly used to secure access to a container image repository?

Your organization stores container images in a cloud-based registry. Compliance requirements mandate that images must be encrypted at rest and that only specific service accounts can access them. What should you configure?

Your CI/CD pipeline builds images and pushes them to a registry. You want to automatically prevent images with high-severity vulnerabilities from being deployed. What is the most effective approach?

Which mechanism is used to verify that a signed container image has not been altered since it was signed?

Your security team is auditing the image repository. They want to ensure that only authenticated users can pull images and that the images have not been altered since they were pushed. Which two mechanisms should be in place?

Keep studying — Platform Security