KCSA Overview OF Cloud Native Security Practice Question
A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It reduces the container attack surface by removing unused binaries and shells
Distroless images reduce the attack surface by excluding unnecessary binaries, package managers, and shells.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It reduces the container attack surface by removing unused binaries and shells
Why this is correct
Removing shells and package managers prevents attackers from executing commands if a container is compromised.
- ✗
It encrypts the container image layers at rest in the registry
Why it's wrong here
Image encryption is handled by registry features, not the base image contents.
- ✗
It automatically configures cloud IAM roles for the container
Why it's wrong here
Base images do not configure cloud IAM.
- ✗
It guarantees zero vulnerabilities in application code dependencies
Why it's wrong here
Application dependencies can still have vulnerabilities regardless of the base image.
About these practice questions
One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.