KCSA Platform Security Practice Question
Which TWO practices are essential for securing container images against supply chain vulnerabilities? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using minimal base images (e.g., Distroless or Alpine) to reduce attack surface
Securing container images requires scanning images for known vulnerabilities and using minimal base images like Distroless or Alpine to reduce the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running all container processes as the root user by default
Why it's wrong here
Running as root increases security risks and should be avoided.
- ✗
Disabling container registry authentication
Why it's wrong here
Disabling registry authentication allows unauthorized access and compromises supply chain integrity.
- ✗
Storing plain-text passwords inside image environment variables
Why it's wrong here
Storing secrets in plaintext environment variables is a major security anti-pattern.
- ✓
Using minimal base images (e.g., Distroless or Alpine) to reduce attack surface
Why this is correct
Minimal base images remove unnecessary shells and utilities, significantly reducing potential exploits.
- ✓
Scanning container images for known CVEs during the CI/CD pipeline
Why this is correct
Scanning images in CI/CD helps catch vulnerabilities before they reach production.
About these practice questions
This KCSA question is part of Courseiva's 320-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.