KCSA Kubernetes Threat Model Practice Question
An organization wants to prevent supply chain attacks where malicious code is injected into third-party Helm charts before deployment. What mitigation technique provides cryptographic verification of Helm chart integrity and authenticity?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verifying Helm chart provenance files using cryptographic signatures and public key rings
Helm supports cryptographically signing charts using Provenance files and verifying them with public key rings prior to installation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restricting etcd database access using client certificate authentication
Why it's wrong here
etcd authentication protects key-value storage, not packaged application release charts.
- ✓
Verifying Helm chart provenance files using cryptographic signatures and public key rings
Why this is correct
Provenance files (`.prov`) contain cryptographic signatures that verify the chart has not been tampered with and comes from a trusted publisher.
- ✗
Disabling anonymous requests in the kube-apiserver configuration
Why it's wrong here
API server authentication stops unauthenticated API callers, not tampered chart templates.
- ✗
Enabling Pod Security Standards in the target namespace
Why it's wrong here
Pod Security Standards govern runtime container behavior, not Helm chart packaging integrity.
About these practice questions
One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.