KCSA Platform Security Practice Question
Which THREE of the following practices are recommended when securing container images to prevent supply chain attacks in a Kubernetes environment? (Choose THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate automated vulnerability scanning into the CI/CD pipeline before pushing images to the container registry.
Securing container images involves pinning image digests instead of relying solely on mutable tags, scanning images for known vulnerabilities prior to deployment, and running containers as non-root users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Always run container processes as the root user (UID 0) to ensure maximum compatibility with host mounts.
Why it's wrong here
Running containers as root is a major security anti-pattern and violates the principle of least privilege.
- ✓
Integrate automated vulnerability scanning into the CI/CD pipeline before pushing images to the container registry.
Why this is correct
Scanning images early in the pipeline prevents vulnerable software packages from reaching production registries.
- ✗
Disable container image pull policies entirely so nodes only rely on locally cached images.
Why it's wrong here
Disabling pull policies prevents nodes from receiving vital security patches and updated base images.
- ✓
Utilize minimal base images (such as distroless or Alpine) to reduce the potential attack surface and remove unnecessary package managers.
Why this is correct
Minimal base images drastically reduce the number of installed packages, lowering CVE exposure and eliminating shell tools for attackers.
- ✓
Reference images by their immutable cryptographic digest (SHA256) rather than mutable tags like latest.
Why this is correct
Using digests ensures that the exact, untampered binary image content is deployed every time.
About these practice questions
One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.