Supply Chain Security KCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A platform team wants to ensure that only container images with no known critical or high vulnerabilities are deployed to their production cluster. They already use a container registry that supports image scanning. Which approach should they use to enforce this requirement at deployment time?

   • AConfigure an admission controller that checks the image scan report and rejects images with critical or high vulnerabilities.
   • BSet the container registry to automatically delete any image with a critical vulnerability.
   • CRun a vulnerability scan manually before each deployment and document the results in a ticket.
   • DUse a base image that is known to be secure and assume all images built from it are safe.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company uses a monorepo containing multiple services. They want to enforce that only the CI/CD system can merge changes to the main branch, and that all other merges must go through a pull request with at least two approvals. However, they also want to allow emergency hotfixes to be deployed quickly. Which approach balances security and operational flexibility?

   • AAllow direct pushes to main only for the CI/CD system, and require PRs for all other changes.
   • BUse a separate branch for hotfixes that bypasses the PR requirement.
   • CEnforce branch protection on main requiring PRs and two approvals, but allow repository admins to bypass these rules in emergencies.
   • DRequire PRs and two approvals for all changes, with no exceptions.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a security incident, a company needs to quickly determine which of their deployed container images contain a specific vulnerable library. They have images running in production but did not keep track of the components in each image. What should they do to enable this analysis in the future?

   • AKeep a list of the base images used for each application.
   • BGenerate and store an SBOM for each image at build time and associate it with the image digest.
   • CRun a vulnerability scan on the production cluster nodes.
   • DStore the Dockerfile for each image in a central repository.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of a software attestation?

   • ATo encrypt the artifact so that only authorized users can download it
   • BTo provide verifiable information about how an artifact was built and by whom
   • CTo automatically fix vulnerabilities found in the artifact
   • DTo compress the artifact to reduce storage costs
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice is essential to ensure the integrity of a CI/CD pipeline?

   • AStoring build logs in a public location for transparency
   • BAllowing developers to manually trigger production deployments at any time
   • CUsing the latest version of all dependencies without pinning
   • DUsing immutable build artifacts and verifying their checksums
   Reveal Solution Discussion Select an answer first