A team is building a new microservice and needs to select a base image. They want to minimize the attack surface and reduce the number of vulnerabilities. Which base image should they choose?

A full-featured image such as ubuntu:latest, which includes common tools and libraries.

An image with the latest tag, which is updated frequently and includes the newest security patches.

A minimal image such as distroless or scratch, containing only the runtime and application dependencies.

An image that includes a package manager so that security updates can be installed at runtime.

What is a Software Bill of Materials (SBOM)?

A formal record containing the details and supply chain relationships of the components used in a software artifact

A list of all the security vulnerabilities found in a software artifact

A list of all the open-source licenses used in a project

A document that describes the deployment architecture of an application

What is the primary purpose of output encoding in secure coding?

To validate that the output matches the expected schema

To encrypt the output so that only authorized users can read it

To prevent cross-site scripting (XSS) by ensuring user input is treated as data, not markup

To compress the output data to reduce bandwidth usage

When should container images be scanned for vulnerabilities in a CI/CD pipeline?

Only after the image is deployed to production

Continuously, including before deployment and on a regular basis

Only when the image is pulled from a public registry

Only when a security incident occurs

Which of the following is a common supply chain attack vector?

Compromising a popular open-source dependency to inject malicious code

SQL injection in a web application

Distributed denial-of-service (DDoS) attacks on a website

Phishing emails sent to end users

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 1

Supply Chain Security KCSA Practice Questions (Page 7)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

13concepts

16%of the exam

13 Concepts in This Objective

Supply Chain Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Secure Code Development
Code Repositories and Version Control Security
Continuous Integration/Continuous Delivery (CI/CD) Security
Artifact Integrity and Provenance
Image Scanning and Vulnerability Management
Signing and Verification of Images
Software Bill of Materials (SBOM)
Secure Base Images and Minimalism
Dependency Management and Pinning
Supply Chain Attacks and Mitigations
Policy and Governance for Supply Chain

Questions 31–35

31application · medium
A team is building a new microservice and needs to select a base image. They want to minimize the attack surface and reduce the number of vulnerabilities. Which base image should they choose?
Select an answer first
32foundation · easy
What is a Software Bill of Materials (SBOM)?
Select an answer first
33foundation · easy
What is the primary purpose of output encoding in secure coding?
Select an answer first
34foundation · easy
When should container images be scanned for vulnerabilities in a CI/CD pipeline?
Select an answer first
35foundation · easy
Which of the following is a common supply chain attack vector?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.