CKS Minimize Microservice Vulnerabilities Practice Question
Which THREE of the following practices help protect microservice applications against supply chain attacks? (Choose three.)
⚠ Common exam trap
CNCF often tests the misconception that using the latest tag is a safe practice for getting patches, when in fact it undermines supply chain security by breaking image immutability and reproducibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use minimal base images (e.g., distroless or scratch) to reduce attack surface
Using minimal base images like distroless or scratch significantly reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could contain vulnerabilities. This aligns with the principle of least functionality, as fewer components mean fewer potential entry points for an attacker to exploit in a supply chain attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use images from any public registry for flexibility
Why it's wrong here
Relying on arbitrary public registries exposes the supply chain to untrusted and unvetted content; attackers can publish malicious images or simply provide outdated packages with known vulnerabilities. Without a curated allowlist of vetted registries, you cannot guarantee image provenance, integrity, or licensing compliance. This flexibility thus introduces serious security risks that automated scanning alone cannot fully mitigate.
- ✓
Use minimal base images (e.g., distroless or scratch) to reduce attack surface
Why this is correct
Minimal images like distroless or scratch contain only the essential runtime dependencies, excluding shells, package managers, and superfluous utilities. This dramatically shrinks the attack surface available to an attacker who gains code execution, limiting exploitation capabilities and reducing the number of CVEs that can affect the image. Fewer components also mean fewer packages to monitor and patch in the base layer.
- ✗
Always use the latest tag to get the most recent patches
Why it's wrong here
The latest tag is a mutable pointer that shifts with every push, so builds become non-reproducible and mystery changes can silently break container behavior. This makes audits and rollbacks difficult because you cannot determine the exact image contents that originally ran. Instead, reference images by immutable digest or a release-specific tag to ensure verifiable, consistent deployments and controlled patch updates.
- ✓
Scan images for vulnerabilities using tools like Trivy or Clair
Why this is correct
Vulnerability scanning queries known CVE databases to enumerate flaws in the image's OS packages and application dependencies before deployment. Automating these scans in the CI pipeline and admission control allows you to block images that exceed the risk threshold and alert on newly disclosed vulnerabilities in running workloads. This gives continuous visibility into your image security posture.
- ✓
Enable image verification using digital signatures (e.g., Notary or Cosign)
Why this is correct
Digital signatures provide cryptographic assurance that an image was produced and signed by a trusted identity and that its contents have not been altered after signing. By integrating verification with admission controllers like OPA or Kyverno, you can enforce that only signed images from approved signers are deployed. This prevents tampering in the registry and supply-chain attacks that modify image content.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.