What is the purpose of role-based access control (RBAC) in an image repository?

To verify the digital signature of images

To scan images for vulnerabilities

To encrypt images stored in the repository

To restrict what actions users can perform based on their assigned roles

What is the primary purpose of scanning container images for vulnerabilities?

To identify known security issues in the image's software components

To verify the image's publisher identity

To compress the image to reduce deployment time

To encrypt the image for secure storage

Your organization uses a private registry with multiple teams. Team A should be able to pull images from the 'shared' repository, but only Team B should be able to push to it. What is the best way to configure this?

Create a role that grants read access to Team A and a separate role that grants write access to Team B, then assign these roles to the respective teams on the 'shared' repository.

Use image signing to allow Team A to verify images before pulling.

Give both teams full admin access to the registry to simplify management.

Make the repository public so anyone can pull, and rely on the registry's firewall.

Your company is adopting a DevSecOps approach. You want to ensure that every container image built from your CI/CD pipeline is traceable to its source code and has not been tampered with. Which combination of practices best achieves this?

Use a private registry and enable multi-factor authentication for all users.

Use a trusted base image, sign the image with a private key, and store the image in a private registry with access controls.

Use a public base image and rely on the registry's built-in vulnerability scanning.

Store the image in a public registry and use a checksum to verify integrity.

What is the purpose of enabling encryption at rest for a container image registry?

To protect the image data from unauthorized access if the storage is compromised

To speed up image pulls by reducing file size

To scan images for vulnerabilities during storage

To verify the identity of users pulling images

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 2

Image Repository KCSA Practice Questions (Page 5)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

16%of the exam

Questions 21–25

21foundation · easy
What is the purpose of role-based access control (RBAC) in an image repository?
Select an answer first
22foundation · easy
What is the primary purpose of scanning container images for vulnerabilities?
Select an answer first
23application · medium
Your organization uses a private registry with multiple teams. Team A should be able to pull images from the 'shared' repository, but only Team B should be able to push to it. What is the best way to configure this?
Select an answer first
24application · medium
Your company is adopting a DevSecOps approach. You want to ensure that every container image built from your CI/CD pipeline is traceable to its source code and has not been tampered with. Which combination of practices best achieves this?
Select an answer first
25foundation · easy
What is the purpose of enabling encryption at rest for a container image registry?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.