CKS Supply Chain Security Practice Question
Which of the following is a best practice when writing a Dockerfile for a containerized application?
⚠ Common exam trap
A common pitfall is assuming that using the 'latest' tag is safe because it gets security patches automatically, but in reality, 'latest' is mutable and can introduce unexpected vulnerabilities or break reproducibility, which is critical for supply chain security in Kubernetes environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a minimal base image such as distroless or alpine
Using a minimal base image like distroless or alpine reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could be exploited. This aligns with the principle of least privilege and minimizes the number of Common Vulnerabilities and Exposures (CVEs) in the container, which is critical for supply chain security in Kubernetes environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run the application as the root user for file permissions
Why it's wrong here
Running as non-root is a security best practice to limit the impact of a compromise.
- ✓
Use a minimal base image such as distroless or alpine
Why this is correct
Minimal images reduce the number of packages and potential vulnerabilities.
- ✗
Hardcode credentials in the Dockerfile for convenience
Why it's wrong here
Credentials should never be hardcoded; they should be injected via secrets or environment variables at runtime.
- ✗
Use the latest tag for the base image to get the newest features
Why it's wrong here
Using 'latest' is unpredictable and can introduce breaking changes or vulnerabilities. Pinned tags or digests are recommended.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.