What is the purpose of maintaining immutable image provenance?

To automatically scan images for vulnerabilities

To encrypt the image during transmission

To provide a verifiable record of an image's origin and build history

To prevent images from being deleted from the registry

When should container images be scanned for vulnerabilities to minimize risk?

Only after a security incident occurs

Before deployment, as part of the CI/CD pipeline

Only when the image is deleted from the registry

Only when the image is pulled from a public registry

Your organization uses a private registry with multiple teams. Team A needs to pull images from the 'shared' repository, but only Team B should be able to push to it. Additionally, you want to ensure that images are not tampered with after being pushed. What is the most comprehensive approach?

Use image scanning to detect vulnerabilities and block pushes with critical issues.

Configure RBAC to grant Team A read access and Team B write access to the 'shared' repository, and enable image signing with verification.

Give both teams full admin access to the registry and rely on the registry's audit logs.

Make the repository public and use a checksum to verify integrity.

Your team uses a base image from a public repository. A vulnerability scan of your application image reports a critical vulnerability in a system library inherited from the base image. What is the most appropriate action?

Disable the vulnerability scanner to avoid false positives.

Update the base image to a patched version and rebuild your application image.

Apply a runtime security policy to block the vulnerable library.

Use a different base image that is not scanned.

Which practice is recommended to minimize the exposure of container images to unauthorized parties?

Disabling encryption for faster image pulls

Publishing images to a public registry for transparency

Storing images in a private registry with access controls

Using a single shared registry for all teams without access controls

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 2

Image Repository KCSA Practice Questions (Page 4)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

16%of the exam

Questions 16–20

16foundation · easy
What is the purpose of maintaining immutable image provenance?
Select an answer first
17foundation · easy
When should container images be scanned for vulnerabilities to minimize risk?
Select an answer first
18expert · hard
Your organization uses a private registry with multiple teams. Team A needs to pull images from the 'shared' repository, but only Team B should be able to push to it. Additionally, you want to ensure that images are not tampered with after being pushed. What is the most comprehensive approach?
Select an answer first
19application · medium
Your team uses a base image from a public repository. A vulnerability scan of your application image reports a critical vulnerability in a system library inherited from the base image. What is the most appropriate action?
Select an answer first
20foundation · easy
Which practice is recommended to minimize the exposure of container images to unauthorized parties?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.