CKS Supply Chain Security — 20 Questions

Question 1

Which TWO of the following are best practices for securing the container supply chain?

Accepted Answer

Scan images for vulnerabilities in a CI pipeline before deploying.. Scanning images for vulnerabilities in a CI pipeline before deployment is a best practice because it catches known CVEs early, preventing vulnerable images from reaching production. Tools like Trivy, Clair, or Grype integrate into CI/CD to enforce policy gates, ensuring only compliant images proceed.

Answer

Embed API keys directly in container images for authentication.

Answer

Allow all images from any registry without verification to speed up development.

Answer

Use mutable tags like 'latest' for easier updates.

Question 2

Which THREE of the following are required to implement a secure software supply chain using Kubernetes native features?

Accepted Answer

Use vulnerability scanning tools like Trivy or Grype in the CI/CD pipeline.. Vulnerability scanning tools like Trivy or Grype are essential for identifying known CVEs in container images before deployment. Integrating these tools into the CI/CD pipeline ensures that only images with an acceptable vulnerability posture are built and pushed to the registry, forming a foundational security gate in the software supply chain.

Answer

Disable admission controllers to reduce latency in pod creation.

Answer

Run all containers as root inside the pod to avoid permission issues.

Question 3

A DevOps team wants to ensure that only signed images from a trusted registry are deployed in the cluster. They plan to use a webhook to intercept pod creation. Which tool is best suited for this task?

Accepted Answer

Kyverno with a verifyImages rule. Kyverno is a Kubernetes-native policy engine that can enforce image signature verification via its `verifyImages` rule. It intercepts pod creation through a dynamic admission webhook, checking that container images are signed with a trusted key (e.g., using Sigstore/Cosign) before the pod is admitted. This directly meets the requirement to only allow signed images from a trusted registry.

Answer

kubectl with --validate flag

Answer

Helm with signed charts

Answer

etcd with encryption at rest

Answer

Prometheus with alerting rules

Question 4

A security audit reveals that a container image running in production contains a critical vulnerability (CVE-2024-1234). The image was built from a base image that had the vulnerability. What is the MOST effective long-term solution to prevent such issues?

Accepted Answer

Rebuild the image using a patched base image and integrate vulnerability scanning into the CI pipeline.. The most effective long-term solution because it addresses the root cause by rebuilding the image from a patched base image, eliminating the vulnerability at the source. Integrating vulnerability scanning into the CI pipeline ensures that future images are automatically checked for known CVEs before deployment, preventing vulnerable images from reaching production. This aligns with the principle of shifting security left in the software supply chain.

Answer

Use a runtime security tool like Falco to detect exploitation attempts.

Answer

Patch the vulnerability by installing a security update inside the running container.

Answer

Add an admission controller that rejects images with vulnerabilities.

Answer

Switch to a different container runtime that is immune to the vulnerability.

Question 5

An organization uses a private container registry and wants to ensure that only images built from a specific CI/CD pipeline are deployed. Which combination of measures provides the strongest guarantee?

Accepted Answer

Generate signed attestations with in-toto during the CI pipeline and verify them using an admission webhook like Kyverno.. It implements a complete chain of custody for container images. In-toto generates signed attestations that record every step of the CI/CD pipeline (e.g., source code checkout, build, test), and an admission webhook like Kyverno verifies these attestations before allowing a pod to run. This ensures that only images that passed the exact, attested pipeline are deployed, providing the strongest guarantee against unauthorized or tampered images.

Answer

Implement network policies to restrict egress from pods to the registry.

Answer

Grant registry write access only to the CI system's service account.

Answer

Use a static analysis tool to check the Dockerfile before building.

Answer

Use a unique registry path and restrict access via firewall rules.

Question 6

You are the lead security engineer for a large financial institution. The organization runs a Kubernetes cluster with 500+ microservices. The supply chain security team has implemented the following measures: (1) All images are built from a minimal base image (distroless) and scanned with Trivy before being pushed to a private registry. (2) Images are signed using cosign with a key stored in a hardware security module (HSM). (3) Kyverno policies enforce that only signed images from the private registry can run, and also enforce that containers run as non-root. (4) A binary authorization (binauthz) style admission controller verifies attestations. Recently, a critical vulnerability (CVE-2024-0001) was discovered in a popular open-source library used by several microservices. The library is included as a dependency in the base image. The vulnerability is remotely exploitable and has a CVSS score of 9.8. The security team needs to remediate this quickly. They have already patched the library and updated the base image. What is the BEST course of action to ensure all running pods use the new image?

Accepted Answer

Update the image tag in each Deployment's spec to point to the new patched image, then perform a rolling update. The admission controller will verify signatures and attestations for the new image.. Updating the image tag in each Deployment triggers a rolling update, which creates new pods with the patched image. The admission controller (Kyverno) will verify the cosign signature and binary authorization attestation for the new image, ensuring supply chain security is maintained. This approach is the standard Kubernetes method for deploying image updates while preserving security controls.

Answer

SSH into each node, pull the new image, and use kubectl exec to update the library inside running containers.

Answer

Temporarily disable the admission controller that verifies signatures and then update the image tags.

Answer

Delete all running pods and let the ReplicaSets recreate them from the existing image.

Question 7

An organization uses a GitOps workflow with Argo CD to deploy applications to Kubernetes. The security team wants to ensure that container images are immutable and signed. They currently use a private container registry (Harbor) with vulnerability scanning and Cosign for signing. Which combination of controls best enforces that only signed and scanned images are deployed?

Accepted Answer

Enable Harbor's content trust feature to reject unsigned images, and use a Kyverno admission rule to verify Cosign signatures at deploy time.. It enforces a two-layer defense: Harbor's content trust rejects unsigned images at the registry level, and a Kyverno admission rule verifies Cosign signatures at deploy time. This ensures that even if an unsigned image bypasses the registry, it will be blocked by Kubernetes admission control, providing defense in depth for supply chain security.

Answer

Configure Argo CD to verify Cosign signatures before syncing the application.

Answer

Use imagePullSecrets in Kubernetes to ensure only Harbor images are used.

Answer

Add a Cosign verification step in the CI pipeline before pushing images to Harbor, and rely on that guarantee.

Question 8

You are auditing a cluster's supply chain security. You find that many pods are running images from public registries without any pinning or verification. Which TWO actions would most effectively reduce the risk of pulling malicious images?

Accepted Answer

Configure all deployments to use image digests instead of tags.. Using image digests (e.g., `nginx@sha256:abc123...`) pins the image to an immutable content hash, ensuring that the exact same image is pulled every time, even if the tag is updated to a malicious version. This prevents tag-mutation attacks where an attacker replaces a benign image tag with a compromised one. Digests are verified by the container runtime (containerd) against the registry's manifest, providing cryptographic assurance of image integrity.

Answer

Implement RBAC to restrict which users can create pods.

Answer

Enforce PodSecurityStandard baseline or restricted to block privileged containers.

Answer

Apply a network policy that blocks egress traffic to public registries.

Question 9

You are securing a Kubernetes cluster that runs workloads from multiple teams. The cluster uses a private container registry and an admission controller to enforce image policies. Which TWO of the following actions are most effective in preventing the use of unapproved or tampered container images? (Choose two correct answers.)

Accepted Answer

Deploy Kyverno with a policy that requires images to have a specific annotation indicating they passed a security scan.. Kyverno can enforce policies that require images to have specific annotations, such as one indicating a passed security scan. This ensures only images that have been verified by your security pipeline are allowed to run, directly preventing unapproved or tampered images from being deployed.

Answer

Use OPA Gatekeeper to enforce a policy that rejects pods using images with the 'latest' tag.

Answer

Configure imagePullSecrets for each namespace to ensure only authorized service accounts can pull images.

Answer

Implement a NetworkPolicy that blocks egress traffic from the cluster to unauthorized container registries.

Question 10

Refer to the exhibit. A cluster has the ClusterImagePolicy shown. A developer creates a pod with an image from registry.example.com/myapp:v1, which was built and signed by a GitHub Actions workflow that is NOT defined in the policy (different workflow). Which behavior will occur when the pod is created?

Accepted Answer

The pod is denied because the image's signer identity does not match the policy.. The ClusterImagePolicy enforces that images must be signed by a specific identity (the GitHub Actions workflow defined in the policy). The image from registry.example.com/myapp:v1 was signed by a different workflow, so the signer identity does not match the policy's required identity. Sigstore keyless signing verifies the OIDC identity embedded in the signature, and if the identity does not match the policy's `issuer` and `subject` patterns, the admission controller denies the pod.

Answer

The pod is admitted because keyless signing does not enforce identity matching.

Answer

The pod is admitted because the policy only applies to images with a tag 'v*'.

Answer

The pod is admitted because the image is from the allowed registry.

Question 11

Arrange the steps to secure etcd in a Kubernetes cluster.

Accepted Answer

Generate TLS certificates, then configure etcd with TLS, then restart etcd, then verify health and restrict network access. Securing etcd involves TLS configuration, restarting, health verification, and network restriction.

Answer

Configure etcd with TLS, then generate TLS certificates, then restart etcd, then verify health and restrict network access

Answer

Generate TLS certificates, then restart etcd, then configure etcd with TLS, then verify health and restrict network access

Answer

Restrict network access to etcd, then generate TLS certificates, then configure etcd with TLS, then restart etcd

Question 12

Match each Kubernetes API server flag to its security function.

Accepted Answer

--authorization-mode=RBAC: Enables RBAC authorization. Correct matches: --authorization-mode=RBAC enables RBAC; --anonymous-auth=false disables anonymous auth; --profiling=false disables profiling. Common confusions involve mixing authorization and authentication flags.

Answer

--authorization-mode=RBAC: Enables anonymous authentication

Answer

--anonymous-auth=false: Enables RBAC

Answer

--profiling=false: Enables audit logging

Question 13

A security engineer wants to ensure that only images signed with a specific key are allowed to run in the cluster. Which tool can be used to sign container images?

Accepted Answer

cosign. Cosign is the correct tool because it is specifically designed for signing and verifying container images using cryptographic keys, integrating directly with OCI-compliant registries. It supports keyless signing via Fulcio and transparency logs via Rekor, making it the standard choice for enforcing image signature verification in Kubernetes admission controllers like Kyverno or OPA.

Answer

kubesec

Answer

syft

Answer

trivy

Question 14

A developer wants to create a Deployment that runs as a non-root user. Which YAML snippet correctly sets the security context to run the container with UID 1000?

Accepted Answer

spec.containers[].securityContext.runAsUser: 1000. `securityContext.runAsUser: 1000` explicitly sets the container's user ID to 1000, ensuring the container process runs as a non-root user. This is the direct way to enforce a specific UID in Kubernetes, meeting the developer's requirement to run as a non-root user.

Answer

spec.containers[].securityContext.runAsUser: 0

Answer

spec.containers[].securityContext.runAsNonRoot: true

Answer

spec.containers[].securityContext.runAsGroup: 1000

Question 15

You are configuring an ImagePolicyWebhook admission controller to allow only images from a trusted registry 'trusted-registry.io'. Which flag must be set in the kube-apiserver configuration to enable the webhook?

Accepted Answer

--admission-control-config-file. The ImagePolicyWebhook admission controller requires an external configuration file to specify the webhook server URL, CA bundle, and other settings. The `--admission-control-config-file` flag points to this file, which the kube-apiserver reads to enable and configure the webhook for image policy validation.

Answer

--pod-security-policy

Answer

--image-policy-webhook-config

Answer

--enable-admission-plugins=ImagePolicyWebhook

Question 16

A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is the correct tool because it allows you to define and enforce custom admission control policies via ConstraintTemplates and Constraints. You can create a policy that rejects any Pod using an image tagged with 'latest' by inspecting the `spec.containers[].image` field at admission time, which is not possible with native Kubernetes resources.

Answer

ResourceQuota

Answer

NetworkPolicy

Answer

PodSecurityPolicy (PSP)

Question 17

Developer A runs 'cosign verify --key cosign.pub myregistry/myimage:tag' and receives an error: 'No signatures found'. Developer B previously ran 'cosign sign --key cosign.key myregistry/myimage:tag'. What is the most likely cause of the verification failure?

Accepted Answer

The signing command failed to push the signature to the registry. The error 'No signatures found' indicates that the verification process could not locate any signature associated with the image in the registry. Since Developer B attempted to sign the image with 'cosign sign', the most likely cause is that the signing command failed to push the signature artifact (typically stored as a separate tag like 'myimage:sha256-<digest>.sig' in the same registry) to the registry. Without the signature being successfully uploaded, the 'cosign verify' command finds nothing to validate against the provided public key.

Answer

The image tag does not exist in the registry

Answer

Developer B used a different private key to sign than the public key used for verification

Answer

Developer A used the public key instead of the private key

Question 18

Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?

Accepted Answer

syft. Syft is a CLI tool purpose-built for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to extract package metadata (e.g., dpkg, RPM, APK, Python, Node.js) and outputs the SBOM in formats like CycloneDX or SPDX, which are the industry standards for supply chain transparency.

Answer

kubesec

Answer

trivy

Answer

cosign

Question 19

A DevOps engineer is setting up a CI/CD pipeline to scan container images for vulnerabilities. They want to fail the pipeline if any critical vulnerabilities are found. Which command should they use to scan the image and produce a JSON output that can be parsed?

Accepted Answer

trivy image --severity CRITICAL --output json myimage:tag. `trivy image` scans a container image (not filesystem), and the `--severity CRITICAL` flag filters results to critical vulnerabilities only, while `--output json` produces machine-parseable JSON output. This allows the CI/CD pipeline to parse the JSON and fail the build if any critical vulnerabilities are present, meeting the requirement exactly.

Answer

trivy fs --severity CRITICAL --output json .

Answer

trivy image --format table myimage:tag

Answer

trivy image --severity HIGH myimage:tag

Question 20

You have configured Kyverno to enforce that all Pods must have an image from a trusted registry. However, a newly created Pod is not being rejected even though it uses an untrusted image. What is the most likely reason?

Accepted Answer

The Kyverno webhook is not invoked because the failure policy is set to Ignore or the resource is not matched by the policy's rules. Kyverno operates as a dynamic admission controller via a MutatingAdmissionWebhook or ValidatingAdmissionWebhook. If the webhook's failure policy is set to `Ignore`, the webhook will not block the Pod creation when it fails to invoke, and the Pod will be admitted. Additionally, if the policy's rules do not match the Pod (e.g., due to incorrect resource selection or namespace exclusion), the webhook will not be triggered, allowing untrusted images through.

Answer

Kyverno is not an admission controller; it only mutates resources

Answer

The Kyverno policy requires an external registry to compare images, which is unavailable

Answer

The Pod was created by a Deployment controller, which bypasses admission control