Supply Chain Security KCSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of signing a container image?

   • ATo automatically update the image when a new version is released
   • BTo compress the image layers for faster download
   • CTo encrypt the image so that only authorized users can pull it
   • DTo prove the image's origin and ensure it has not been tampered with
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a key consideration when selecting a secure base image?

   • AIt should be built from source code every time to ensure freshness
   • BIt should be regularly updated and patched by the maintainers
   • CIt should include a full operating system with all common tools
   • DIt should be the largest image available to ensure all features are present
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a policy that all images must be free of critical vulnerabilities before deployment. However, a critical vulnerability is found in a base image that is used by many applications. The team needs to remediate the vulnerability quickly without breaking existing deployments. Which approach is most effective?

   • AUpdate the base image to a patched version, rebuild all affected images, and redeploy them using a rolling update strategy.
   • BApply a runtime security patch to the running containers using a sidecar container.
   • CChange the admission policy to allow images with critical vulnerabilities temporarily.
   • DUse a different base image that is not affected, even if it is larger and has more components.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A CI/CD pipeline for a Kubernetes application uses a service account with permissions to push images to the container registry and update deployments in the cluster. The service account credentials are stored as plain text in the pipeline configuration. What is the most effective way to protect these credentials?

   • AEncrypt the pipeline configuration file with a password and store the password in the repository.
   • BCreate a new service account for each pipeline run and delete it after the run.
   • CUse the service account credentials directly in the pipeline and rotate them monthly.
   • DStore the credentials in a secrets manager and reference them in the pipeline using the secrets manager's integration.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A team uses a Python application with many third-party packages. They want to ensure that the application is built with the same versions of dependencies every time and that known vulnerabilities are caught before deployment. Which two practices should they implement together?

   • AUse the latest versions of all dependencies and run a vulnerability scanner only in production.
   • BPin only the direct dependencies in requirements.txt and rely on the package manager to resolve transitive dependencies.
   • CUse a lock file (e.g., Pipfile.lock or poetry.lock) and run a vulnerability scanner on the dependencies during CI.
   • DGenerate an SBOM after deployment and scan it for vulnerabilities.
   Reveal Solution Discussion Select an answer first