A company's container registry was compromised, and an attacker replaced a legitimate image with a malicious one that has the same tag. The company's deployment pipeline pulls images by tag, not digest. What is the most effective way to prevent this type of attack in the future?

Configure the deployment pipeline to reference images by digest instead of tag, and verify the image signature before deployment.

Use a tag that includes the build number and timestamp.

Use a private registry and restrict access to only the deployment pipeline.

Scan images for vulnerabilities before deployment.

Why is it recommended to use minimal base images for containers?

To ensure the image is compatible with all Kubernetes versions

To avoid the need for image scanning

To make the image run faster by using a smaller kernel

To reduce the attack surface by including only necessary components

What is the primary purpose of container image scanning?

To identify known vulnerabilities in the image's packages and dependencies

To test the application's functionality

To encrypt the image layers for secure storage

To optimize the image size for faster deployment

What is the primary purpose of a lock file (e.g., package-lock.json or requirements.txt with pinned versions)?

To record the exact versions of dependencies used in a project

To automatically fix vulnerabilities in dependencies

To encrypt the dependency files

To prevent developers from adding new dependencies

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 1

Supply Chain Security KCSA Practice Questions (Page 3)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

13concepts

16%of the exam

13 Concepts in This Objective

Supply Chain Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Secure Code Development
Code Repositories and Version Control Security
Continuous Integration/Continuous Delivery (CI/CD) Security
Artifact Integrity and Provenance
Image Scanning and Vulnerability Management
Signing and Verification of Images
Software Bill of Materials (SBOM)
Secure Base Images and Minimalism
Dependency Management and Pinning
Supply Chain Attacks and Mitigations
Policy and Governance for Supply Chain

Questions 11–15

11expert · hard
A company's container registry was compromised, and an attacker replaced a legitimate image with a malicious one that has the same tag. The company's deployment pipeline pulls images by tag, not digest. What is the most effective way to prevent this type of attack in the future?
Select an answer first
12foundation · easy
Why is it recommended to use minimal base images for containers?
Select an answer first
13foundation · easy
Which phase of a Secure Software Development Lifecycle (SSDLC) involves conducting code reviews and static analysis to identify vulnerabilities early?
Select an answer first
14foundation · easy
What is the primary purpose of container image scanning?
Select an answer first
15foundation · easy
What is the primary purpose of a lock file (e.g., package-lock.json or requirements.txt with pinned versions)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.