A development team uses a public base image from Docker Hub in their CI pipeline. A security review reveals that the image tag they reference is mutable and could be overwritten by an attacker. Which action best reduces this supply chain risk?

Switch to a smaller base image to reduce the attack surface.

Copy the image into a private registry and reference it by tag.

Pin the image to a specific digest and enforce that digest in the pipeline.

Use the latest tag and add a vulnerability scan step in the pipeline.

A security team wants to identify known vulnerabilities in the open-source libraries used by their application before deployment. Which tool category is most appropriate for this task?

Runtime security monitoring tool

Software Composition Analysis (SCA) tool

Dynamic Application Security Testing (DAST) tool

Static Application Security Testing (SAST) tool

Which of the following is an example of a secure coding standard?

Storing passwords in plain text for easier debugging

Using global variables to share data across functions

Disabling all security warnings in the compiler

Using parameterized queries to prevent SQL injection

What is a key characteristic of immutable infrastructure?

Components are replaced rather than modified in place

Components are manually patched on a regular basis

Components are allowed to drift from their original configuration

Components are updated in place with configuration management tools

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 1Objective 6

Workload and Application Code Security KCSA Practice Questions (Page 4)

Part of the Overview of Cloud Native Security domain, which accounts for 14% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

14%of the exam

Questions 16–20

16application · medium
A development team uses a public base image from Docker Hub in their CI pipeline. A security review reveals that the image tag they reference is mutable and could be overwritten by an attacker. Which action best reduces this supply chain risk?
Select an answer first
17application · medium
A security team wants to identify known vulnerabilities in the open-source libraries used by their application before deployment. Which tool category is most appropriate for this task?
Select an answer first
18foundation · easy
Which of the following is an example of a secure coding standard?
Select an answer first
19foundation · easy
Which of the following is a runtime security measure that confines a container's access to filesystem paths?
Select an answer first
20foundation · easy
What is a key characteristic of immutable infrastructure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.