Workload and Application Code Security KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does immutable infrastructure enable secure rollbacks?

   • ABy allowing in-place patching of the running container
   • BBy storing backups of all data in a separate location
   • CBy keeping a history of previous versions that can be redeployed
   • DBy automatically reverting changes when a vulnerability is detected
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's CI pipeline builds images from a base image that is pulled from a public registry. The security team wants to ensure that the base image has not been tampered with and that the build process is reproducible. Which combination of measures best addresses these concerns?

   • ACopy the base image to a private registry and use a mutable tag.
   • BUse the latest tag and scan the image after the build.
   • CRebuild the base image from source code every time.
   • DVerify the base image's signature and pin it to a digest.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer wants to find security flaws in the application's source code before it is committed. Which tool is best suited for this?

   • AStatic Application Security Testing (SAST) tool
   • BDynamic Application Security Testing (DAST) tool
   • CContainer image scanner
   • DRuntime security monitor
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multi-tenant cluster runs workloads from different business units. A security audit requires that a compromise in one workload must not affect other tenants. Which combination of measures provides the strongest isolation?

   • ASeparate namespaces with resource quotas only.
   • BDisable all network policies to simplify management.
   • CUse the same nodes for all tenants but apply different labels.
   • DDedicated nodes per tenant with NetworkPolicies and Pod Security Standards.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is hardening a container that runs a legacy application. The application requires a few specific system calls that are not in the default seccomp profile. The team wants to minimize the attack surface while keeping the application functional. What is the best approach?

   • ACreate a custom seccomp profile that allows only the required system calls.
   • BDisable seccomp entirely to avoid compatibility issues.
   • CRun the container with the host's seccomp profile.
   • DUse the default seccomp profile and hope the application works.
   Reveal Solution Discussion Select an answer first