Workload and Application Code Security KCSA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A team is migrating a monolithic application to Kubernetes. The application currently reads database credentials from a configuration file. The team wants to avoid storing secrets in the image and also wants to rotate credentials without restarting the pod. Which approach best meets both requirements?

   • AInject the secret as an environment variable.
   • BMount the secret as a volume and have the application watch for file changes.
   • CUse a sidecar container to fetch the secret once at startup.
   • DStore the secret in the image and rebuild it on rotation.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team wants to enforce that only images from a trusted registry with a valid signature can be deployed. They also want to block images with critical vulnerabilities. Which approach is most effective?

   • AUse a NetworkPolicy to block traffic from unapproved images.
   • BRely on developers to manually check image signatures and scan reports.
   • CStore approved image digests in a ConfigMap and hope developers use them.
   • DUse an admission controller that verifies signatures and checks vulnerability scan results.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a key risk of hardcoding secrets in application code?

   • ASecrets are only accessible to authorized users
   • BSecrets are rotated automatically
   • CSecrets are automatically encrypted by the container runtime
   • DSecrets become visible in version control history
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A team wants to ensure that the container image used in production is exactly the same as the one tested in staging. Which practice is most aligned with immutable infrastructure?

   • AUse the same image digest in both staging and production.
   • BPatch the running container in production to fix issues.
   • CAllow production to pull the latest tag at deployment time.
   • DRebuild the image in production with different build arguments.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of scanning container images for vulnerabilities?

   • ATo compress the image to reduce its size
   • BTo verify the image's provenance and origin
   • CTo encrypt the image so it cannot be tampered with
   • DTo identify known vulnerabilities in the image's software components
   Reveal Solution Discussion Select an answer first