A company's CI/CD pipeline builds and deploys a container image to production. The pipeline is triggered by pull requests from forks. A developer notices that a pull request from an unknown contributor includes a change to the pipeline configuration that would exfiltrate secrets. What is the most effective way to prevent this type of attack?

Review the pipeline configuration changes in the pull request before merging.

Sign all commits in the repository and require verified commits for all PRs.

Use a secrets manager and ensure that secrets are not available to fork PRs.

Disable pipeline execution for pull requests from forks and require maintainers to run the pipeline manually after review.

Which repository security control is specifically designed to prevent unauthorized changes to critical branches like 'main'?

Two-factor authentication for all users

What is the primary purpose of commit signing in a version control system?

To encrypt the contents of the repository so that only authorized users can read it

To verify the identity of the author and ensure the commit has not been tampered with

To prevent unauthorized users from cloning the repository

To automatically merge branches without conflicts

What is the role of admission controllers in enforcing supply chain security policies in Kubernetes?

To scan container images for vulnerabilities at runtime

To automatically patch vulnerabilities in running containers

To intercept requests to the Kubernetes API server and apply policies before resources are created

To encrypt all traffic between pods

How does an SBOM help in managing supply chain risks?

By encrypting all components to prevent unauthorized access

By enabling quick identification of affected components when a vulnerability is disclosed

By automatically patching vulnerabilities in all components

By providing a backup of all source code

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 1

Supply Chain Security KCSA Practice Questions (Page 6)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

13concepts

16%of the exam

13 Concepts in This Objective

Supply Chain Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Secure Code Development
Code Repositories and Version Control Security
Continuous Integration/Continuous Delivery (CI/CD) Security
Artifact Integrity and Provenance
Image Scanning and Vulnerability Management
Signing and Verification of Images
Software Bill of Materials (SBOM)
Secure Base Images and Minimalism
Dependency Management and Pinning
Supply Chain Attacks and Mitigations
Policy and Governance for Supply Chain

Questions 26–30

26expert · hard
A company's CI/CD pipeline builds and deploys a container image to production. The pipeline is triggered by pull requests from forks. A developer notices that a pull request from an unknown contributor includes a change to the pipeline configuration that would exfiltrate secrets. What is the most effective way to prevent this type of attack?
Select an answer first
27foundation · easy
Which repository security control is specifically designed to prevent unauthorized changes to critical branches like 'main'?
Select an answer first
28foundation · easy
What is the primary purpose of commit signing in a version control system?
Select an answer first
29foundation · easy
What is the role of admission controllers in enforcing supply chain security policies in Kubernetes?
Select an answer first
30foundation · easy
How does an SBOM help in managing supply chain risks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.