CKS Practice Test 26 — 15 Questions

Question 1

A cluster has both ImagePolicyWebhook and a mutating webhook that adds a sidecar. The admin notices that even when ImagePolicyWebhook rejects an image, the mutating webhook has already added the sidecar. What admission ordering issue is occurring?

Accepted Answer

The ImagePolicyWebhook should be placed before the mutating webhook in the webhook configuration. Mutating webhooks run before validating webhooks. If a mutating webhook runs first, it may modify the pod spec, and the validation may see the modified version.

Answer

Validating webhooks should run before mutating webhooks

Answer

Use a validating webhook instead of ImagePolicyWebhook

Answer

The mutating webhook should be configured to skip pods with certain images

Question 2

You want to scan a container image for vulnerabilities before deploying it. Which command uses the Trivy tool to scan an image?

Accepted Answer

trivy image nginx:latest. The correct command to scan a container image with Trivy is 'trivy image'. Option A uses 'trivy fs' which scans a filesystem, not an image.

Answer

trivy check nginx:latest

Answer

trivy fs nginx:latest

Answer

trivy scan nginx:latest

Question 3

An administrator applies the following Kyverno policy to the cluster. What is the effect of this policy?

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: enforce
  rules:
  - name: check-runAsNonRoot
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Running as root is not allowed."
      pattern:
        spec:
          securityContext:
            runAsNonRoot: true

Accepted Answer

It denies all Pods that do not specify a security context. The policy enforces that all Pods must have 'runAsNonRoot: true' in their security context. If a Pod does not have this setting, it will be rejected (enforce mode).

Answer

It allows Pods that run as root if they have a reason

Answer

It applies only to Pods in the default namespace

Answer

It only audits Pods and does not block them

Question 4

You are tasked with creating a Kubernetes admission controller that validates image signatures before allowing pods to run. Which admission controller should you configure?

Accepted Answer

ImagePolicyWebhook. ImagePolicyWebhook is the admission controller that can be configured to validate images against an external webhook, typically used for image signature verification.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

NodeRestriction

Question 5

An administrator runs 'trivy image --severity HIGH,CRITICAL myapp:v1.0' and sees no vulnerabilities. However, a security scan of the same image using a different tool reports several HIGH severity CVEs. What is the MOST likely reason for this discrepancy?

Accepted Answer

The image was scanned with an outdated vulnerability database. Trivy uses different vulnerability databases and may not include all sources (e.g., Red Hat OVAL, OSV). The other tool might use a broader set of databases, explaining the additional found CVEs.

Answer

Trivy only scans the application layer and ignores the base image

Answer

Trivy cannot scan images stored in private registries

Answer

The other tool has false positives

Question 6

An OPA/Gatekeeper constraint is configured to allow only images from 'trusted-registry.io'. A pod is created with image 'trusted-registry.io/app:v1' but is denied. Which is the MOST likely cause?

Accepted Answer

The constraint uses regex and the image does not match the pattern. Gatekeeper constraints can enforce specific registries. If the constraint does not match the exact registry name (e.g., missing port or path), the pod will be denied.

Answer

The constraint is only applied in the default namespace

Answer

The image tag is not pinned to a digest

Answer

The image is not signed

Question 7

Which admission controller runs FIRST in the Kubernetes admission flow?

Accepted Answer

MutatingAdmissionWebhook. The MutatingAdmissionWebhook runs first, before ValidatingAdmissionWebhook, as mutations must be applied before validation.

Answer

ResourceQuota

Answer

ValidatingAdmissionWebhook

Answer

ImagePolicyWebhook

Question 8

A security engineer wants to scan a container image for vulnerabilities using Trivy. Which command should they use?

Accepted Answer

trivy image . Trivy's image scanning command is 'trivy image '. The other options are incorrect: 'trivy scan' is not a valid subcommand, 'trivy repo' scans a repository, and 'trivy fs' scans a filesystem.

Answer

trivy scan <image-name>

Answer

trivy repo <image-name>

Answer

trivy fs <image-name>

Question 9

A security team wants to generate an SBOM for a container image. Which tool should they use?

Accepted Answer

Syft. Syft generates SBOMs for container images. Trivy and Clair are vulnerability scanners. Cosign is for signing. Syft is specifically designed for SBOM generation.

Answer

Clair

Answer

Trivy

Answer

Cosign

Question 10

Which of the following is a static analysis tool for Kubernetes manifests?

Accepted Answer

Kubesec. Kubesec is a static analysis tool that evaluates Kubernetes resources against security best practices. The others are not static analysis tools for manifests.

Answer

Cosign

Answer

Trivy

Answer

Syft

Question 11

Which of the following is a recommended Dockerfile best practice to improve container security?

Accepted Answer

Use a non-root user with USER directive. Using a non-root user limits the privileges within the container, reducing the impact of a compromise.

Answer

Hardcode secrets in environment variables in the Dockerfile

Answer

Run the container as root to simplify permission management

Answer

Copy the entire host filesystem into the image

Question 12

Which THREE of the following are best practices for securing the software supply chain in a CI/CD pipeline?

Accepted Answer

Sign images with Cosign after building. Scanning images for vulnerabilities, generating SBOMs, and signing images are all key supply chain security practices.

Answer

Use a non-minimal base image to ensure all libraries are available

Answer

Store secrets in the Dockerfile as build args

Question 13

A developer wants to ensure that a pod always uses a specific version of an image that cannot be changed without updating the manifest. Which image reference should be used?

Accepted Answer

myimage@sha256:abcdef.... Using an image digest (SHA256) ensures that the exact image is used, even if the tag is updated. This prevents unauthorized changes to the image without updating the manifest.

Answer

myimage:latest

Answer

myimage:v1.0

Answer

myimage:1.0.0

Question 14

What is the purpose of using a non-root user in a container image?

Accepted Answer

To reduce the attack surface and limit potential damage if the container is compromised. Running containers as a non-root user reduces the risk of privilege escalation attacks. If an attacker compromises the container, they will have limited permissions.

Answer

To improve performance

Answer

To comply with Kubernetes requirements

Answer

To allow the container to bind to privileged ports

Question 15

Which TWO of the following are correct methods to verify a signed container image using Cosign?

Accepted Answer

cosign verify --fulcio-url https://fulcio.example.com myimage:latest. Cosign verify can be used with a public key or with keyless verification using Fulcio. The command 'cosign verify' is not correct; it must specify the key or use keyless.

Answer

cosign verify myimage:latest

Answer

cosign sign --key privkey.pem myimage:latest

Answer

cosign verify --insecure-ignore-sigs myimage:latest