KCSA Software Supply Chain Security Concepts Quiz

1. Which tool or practice verifies that container images have not been tampered with after creation?

Image tagging

Container runtime logging

Cryptographic image signing and verification

Resource quota management

2. What does 'secure-by-default' mean in container image design?

Images are configured with security best practices without requiring manual hardening

All security features are disabled by default

Security is only applied during runtime

Images require root privileges to function

3. Which practice ensures that supply chain security policies are consistently applied across deployments?

Policy-as-Code and infrastructure automation

Manual security reviews for each deployment

Disabling automated validation

Relying on developer memory

4. What is the primary risk of using unverified third-party container images?

Introducing malicious code or vulnerabilities into your environment

Increasing storage capacity

Slowing down container pulls

Reducing pod memory allocation

5. In Kubernetes environments, what role does a webhook play in supply chain security?

It enforces policies by validating or mutating resources before they are created

It automatically scales pod replicas

It manages container registry credentials

It schedules batch jobs

6. Which of the following is a key component of secure container image scanning?

Identifying known vulnerabilities before deployment

Disabling all container logs

Removing security metadata

Allowing unauthenticated image pulls

7. What is the purpose of attestation in software supply chain security?

To create cryptographic proof that an artifact meets security requirements

To compress container layers

To manage Kubernetes persistent volumes

To schedule pod deployments

8. Which practice helps prevent supply chain attacks through dependency confusion?

Using private package repositories and explicitly specifying dependency sources

Installing all packages from public repositories only

Avoiding version pinning in dependency declarations

Using generic package names without versions

9. In supply chain security, what is the significance of using immutable tags for container images?

It prevents accidental or malicious image replacement

It reduces container startup time

It eliminates the need for backups

It simplifies Kubernetes networking

10. What does 'least privilege' mean in the context of container image permissions?

Running containers with only the minimum required permissions and as non-root users

Granting full root access to all containers

Using default Docker configurations

Disabling all security features

11. What is the primary purpose of container image signing in a software supply chain?

To reduce image file size

To verify the authenticity and integrity of container images

To speed up container deployment

To encrypt container layers

12. What is the primary benefit of using a private container registry in a supply chain?

It provides faster internet speeds

It allows control over approved images and prevents unauthorized deployments

It automatically patches all vulnerabilities

It eliminates the need for image scanning

13. Which of these is a critical security practice for managing dependencies in containerized applications?

Regularly updating and patching dependencies

Using the latest versions of all libraries without testing

Ignoring security advisories

Hardcoding dependency versions in Dockerfiles

14. In CI/CD security, what is the purpose of artifact provenance?

To track the origin and history of software artifacts

To compress container images

To manage Kubernetes secrets

To balance pod replicas

15. What does SLSA (Supply-chain Levels for Software Artifacts) provide?

A framework for securing software artifacts and build processes

A Kubernetes storage solution

A container networking standard

A pod scheduling algorithm

16. Which practice reduces supply chain risk by minimizing the number of layers and dependencies in a container image?

Using multi-stage builds

Increasing image size

Running containers as root

Disabling security scanning

17. What is the role of a base image in container security?

It provides the foundational operating system and libraries for the container

It encrypts all container data

It manages Kubernetes ingress rules

It monitors container CPU usage

18. Which mechanism ensures that only approved container images are deployed in a Kubernetes cluster?

Image pull secrets

Pod security policies

Image admission controllers and image verification

Container runtime interfaces

19. In container security, what does vulnerability scanning typically identify?

Network latency issues

Known CVEs and security flaws in base images and dependencies

Kubernetes API server misconfigurations

Pod resource requests

20. Which of the following best describes software Bill of Materials (SBOM)?

A list of all software components and dependencies in an application

A security scanning tool for container images

A Kubernetes network policy configuration

A CI/CD pipeline orchestration framework