CKS Supply Chain Security — 30 Questions

Question 1

Which THREE of the following are required to implement a secure software supply chain using Kubernetes native features?

Accepted Answer

Use vulnerability scanning tools like Trivy or Grype in the CI/CD pipeline.. Vulnerability scanning tools like Trivy or Grype are essential for identifying known CVEs in container images before deployment. Integrating these tools into the CI/CD pipeline ensures that only images with an acceptable vulnerability posture are built and pushed to the registry, forming a foundational security gate in the software supply chain.

Answer

Disable admission controllers to reduce latency in pod creation.

Answer

Run all containers as root inside the pod to avoid permission issues.

Question 2

You are securing a Kubernetes cluster that runs workloads from multiple teams. The cluster uses a private container registry and an admission controller to enforce image policies. Which TWO of the following actions are most effective in preventing the use of unapproved or tampered container images? (Choose two correct answers.)

Accepted Answer

Deploy Kyverno with a policy that requires images to have a specific annotation indicating they passed a security scan.. Kyverno can enforce policies that require images to have a specific annotation, such as one indicating a passed security scan, which helps ensure only images that have been verified by your security pipeline are allowed to run. An ImagePolicyWebhook admission controller can verify image signatures and only allow signed images from your trusted registry, which directly prevents tampered or unsigned images from being deployed. Together, these two controls address both unapproved and tampered images.

Answer

Use OPA Gatekeeper to enforce a policy that rejects pods using images with the 'latest' tag.

Answer

Configure imagePullSecrets for each namespace to ensure only authorized service accounts can pull images.

Answer

Implement a NetworkPolicy that blocks egress traffic from the cluster to unauthorized container registries.

Question 3

You are configuring an ImagePolicyWebhook admission controller to allow only images from a trusted registry 'trusted-registry.io'. Which flag must be set in the kube-apiserver configuration to enable the webhook?

Accepted Answer

--admission-control-config-file. The ImagePolicyWebhook admission controller requires an external configuration file to specify the webhook server URL, CA bundle, and other settings. The `--admission-control-config-file` flag points to this file, which the kube-apiserver reads to enable and configure the webhook for image policy validation.

Answer

--pod-security-policy

Answer

--image-policy-webhook-config

Answer

--enable-admission-plugins=ImagePolicyWebhook

Question 4

A cluster uses ImagePolicyWebhook admission controller. After configuring it, deployments referencing images from an unauthorized registry are blocked. However, some deployments are still being admitted. What is a possible cause?

Accepted Answer

The ImagePolicyWebhook is placed after mutating admission webhooks in the admission chain. The ImagePolicyWebhook admission controller must be placed before mutating admission webhooks in the admission chain. If it is placed after mutating webhooks, a mutating webhook could modify the image reference (e.g., rewriting the registry URL) after the ImagePolicyWebhook has already validated it, effectively bypassing the policy. The order of admission controllers in the kube-apiserver's `--enable-admission-plugins` flag matters, and the ImagePolicyWebhook should be early in the chain to enforce policy before any mutations occur.

Answer

The ImagePolicyWebhook is configured with a low timeout

Answer

The registry is allowlisted in the webhook configuration

Answer

The admission controller is disabled

Question 5

Which tool can be used to generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to catalog packages (e.g., APK, DEB, RPM, Python, Java) and outputs the SBOM in formats like SPDX or CycloneDX, which are industry standards for supply chain transparency. This makes it the correct choice for generating an SBOM from a container image in a CKS context.

Answer

trivy

Answer

kubesec

Answer

checkov

Question 6

An OPA/Gatekeeper constraint requires that all images' registries match a pattern. A Deployment uses 'myregistry.io/app:v1'. The admission controller rejects it. The admin runs 'kubectl get constraints' and sees the constraint is active. What is the next debugging step?

Accepted Answer

Check the admission webhook response or the resource events for the specific denial reason returned by Gatekeeper. When Gatekeeper rejects a resource, the precise denial reason is returned in the admission webhook response (visible in the kubectl apply error) and often recorded in the resource events. Admins should inspect that message to identify the violation, such as a registry pattern mismatch. Describing the constraint template shows the Rego policy but does not display the live denial reason.

Answer

Disable the Gatekeeper webhook

Answer

Check the audit logs of Gatekeeper

Answer

Reapply the Deployment YAML

Question 7

A cluster has both ImagePolicyWebhook and a mutating webhook that adds a sidecar. The admin notices that even when ImagePolicyWebhook rejects an image, the mutating webhook has already added the sidecar. What admission ordering issue is occurring?

Accepted Answer

Validating webhooks should run before mutating webhooks. In Kubernetes, admission controllers are invoked in a fixed order: mutating admission controllers (including MutatingAdmissionWebhook) run before validating ones (including ImagePolicyWebhook and ValidatingAdmissionWebhook). Therefore, the mutating webhook that adds the sidecar runs before ImagePolicyWebhook validates the image. This means even if ImagePolicyWebhook rejects the image, the sidecar has already been added. The issue is that validating webhooks should run before mutating webhooks to prevent such problems, but the fixed order prevents this. Option B is wrong because using a validating webhook still runs after mutating webhooks. Option C is a workaround but not related to the ordering issue. Option D is incorrect because you cannot change the order of built-in admission controllers; the order is fixed.

Answer

Use a validating webhook instead of ImagePolicyWebhook

Answer

The mutating webhook should be configured to skip pods with certain images

Answer

The ImagePolicyWebhook should be placed before the mutating webhook in the webhook configuration

Question 8

A security team wants to ensure that only signed images are deployed in the cluster. They have set up an ImagePolicyWebhook admission controller. After configuring the webhook, they notice that pods with unsigned images are still being created. What is the most likely cause?

Accepted Answer

The ImagePolicyWebhook is not enabled in the kube-apiserver configuration. The ImagePolicyWebhook admission controller must be explicitly enabled in the kube-apiserver configuration via the `--enable-admission-plugins=ImagePolicyWebhook` flag. If it is not enabled, the kube-apiserver will not invoke the webhook at all, allowing unsigned images to be deployed regardless of the webhook's configuration.

Answer

The ImagePolicyWebhook is failing open due to a misconfigured failure policy

Answer

The container runtime does not support image signing

Answer

The images are signed but the signature is invalid

Question 9

Which of the following is a best practice for securing container images?

Accepted Answer

Use distroless base images to minimize the attack surface. Distroless base images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities that could be exploited. This dramatically reduces the attack surface and aligns with the principle of least functionality, making it a best practice for securing container images in Kubernetes environments.

Answer

Run containers as root to ensure all permissions are available

Answer

Use the 'latest' tag for base images to get the latest features

Answer

Embed secrets directly in the Dockerfile for easy access

Question 10

An administrator applies the following Kyverno policy to the cluster. What is the effect of this policy?

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: enforce
  rules:
  - name: check-runAsNonRoot
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Running as root is not allowed."
      pattern:
        spec:
          securityContext:
            runAsNonRoot: true

Accepted Answer

It denies all Pods that do not specify a security context. This Kyverno ClusterPolicy uses `validationFailureAction: enforce` and a `pattern` that requires `spec.securityContext.runAsNonRoot: true`. Because the pattern is a strict match, any Pod that does not explicitly set `runAsNonRoot: true` in its security context will fail validation and be denied. This includes Pods that omit the security context entirely, as the pattern requires the exact field to be present and set to `true`. Therefore, the policy denies all Pods that do not specify a security context with `runAsNonRoot: true`.

Answer

It allows Pods that run as root if they have a reason

Answer

It applies only to Pods in the default namespace

Answer

It only audits Pods and does not block them

Question 11

A cluster administrator notices that a pod using an image from a public registry is failing to start. The image was signed with Cosign, and the cluster has an ImagePolicyWebhook configured to require signatures. The error message from the webhook indicates 'signature verification failed'. What is the most likely cause?

Accepted Answer

The public key used to verify the signature does not match the private key used to sign. The error 'signature verification failed' indicates that the webhook attempted to verify the image's signature but the cryptographic check did not pass. Since the image was signed with Cosign, the most likely cause is that the public key configured in the ImagePolicyWebhook does not correspond to the private key used to sign the image. Cosign uses public-key cryptography (typically ECDSA-P256 or RSA) where the signature can only be verified with the matching public key.

Answer

The image is not signed at all

Answer

The webhook is not reachable

Answer

The image tag is incorrect

Question 12

Which TWO of the following are correct methods to verify a signed container image using Cosign?

Accepted Answer

cosign verify --fulcio-url https://fulcio.example.com myimage:latest. Option A is correct because `cosign verify --fulcio-url https://fulcio.example.com myimage:latest` verifies a signature against a Fulcio certificate chain, allowing you to specify a custom Fulcio instance for keyless verification. Option E is correct because `cosign verify --key pubkey.pem myimage:latest` verifies the image signature using the provided public key, which is the standard key-based verification method. Option B is not a valid verification method because `cosign verify` requires either a `--key` or a `--certificate-identity`/`--certificate-oidc-issuer` (keyless) parameter to know what to verify against. Option C is incorrect because `cosign sign` creates a signature rather than verifying one. Option D is incorrect because `--insecure-ignore-sigs` is not a valid Cosign flag for verification and would not properly validate the signature.

Answer

cosign verify myimage:latest

Answer

cosign sign --key privkey.pem myimage:latest

Answer

cosign verify --insecure-ignore-sigs myimage:latest

Question 13

Which admission controller runs FIRST in the Kubernetes admission flow?

Accepted Answer

MutatingAdmissionWebhook. MutatingAdmissionWebhook is correct because in the Kubernetes admission flow, mutating admission controllers run before validating ones. The API server processes admission controllers in a specific order: mutating webhooks first, then object validation, then validating webhooks. This ensures that any modifications to the object (e.g., sidecar injection) are applied before validation checks occur.

Answer

ResourceQuota

Answer

ValidatingAdmissionWebhook

Answer

ImagePolicyWebhook

Question 14

A security team wants to generate an SBOM for a container image. Which tool should they use?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It can output SBOMs in multiple formats, including CycloneDX and SPDX, which are the industry-standard formats for SBOMs. This makes Syft the correct choice for the security team's requirement.

Answer

Clair

Answer

Trivy

Answer

Cosign

Question 15

An administrator runs 'kubectl run test-pod --image=nginx:latest' and the pod fails to start. The event log shows 'ImagePullBackOff' with error 'manifest for nginx:latest not found: manifest unknown'. The image 'nginx:latest' exists in the registry. What is the most likely cause?

Accepted Answer

The image tag is misspelled or points to a non-existent tag. If the image 'nginx:latest' exists in the registry, the manifest for that tag must exist. The error 'manifest for nginx:latest not found: manifest unknown' indicates that the tag does not exist in the registry. Therefore, the given stem invalidates option C. None of the provided options correctly address the scenario as described.

Answer

The pod is running in a different namespace

Answer

The registry requires authentication

Answer

The image is a multi-architecture image and the node does not support the required architecture

Question 16

Which admission controller is responsible for invoking external webhooks to validate or mutate resources?

Accepted Answer

ValidatingAdmissionWebhook. The ValidatingAdmissionWebhook admission controller is responsible for invoking external webhooks that validate resources. While there is a separate controller, MutatingAdmissionWebhook, for mutation, the question's inclusion of 'or mutate' can be misleading. The correct answer is ValidatingAdmissionWebhook because it handles validation, and the phrase 'validate or mutate' is meant to test the candidate's ability to distinguish between the two controllers.

Answer

ImagePolicyWebhook

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Question 17

An administrator wants to ensure that all containers in a deployment run as a non-root user. Which YAML snippet correctly sets the security context to run as user ID 1000?

Accepted Answer

securityContext:
  runAsUser: 1000. It correctly sets the security context at the pod or container level with the `runAsUser` field, which instructs the container runtime (e.g., containerd) to set the user ID to 1000 for the container's main process. This ensures the container does not run as root (UID 0), aligning with the principle of least privilege.

Answer

runAsUser: 1000

Answer

securityContext: { runAsNonRoot: true }

Answer

user: 1000

Question 18

Which admission controller is responsible for validating and modifying images based on an external webhook in Kubernetes?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to validate and modify container images by querying an external webhook before admitting a pod. It allows an external service to enforce image policies, such as checking image signatures or blocking untrusted registries, making it the correct answer for this scenario.

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Answer

ValidatingAdmissionWebhook

Question 19

An OPA/Gatekeeper constraint is configured to require all container images to be from a specific registry. A user creates a Pod with image 'gcr.io/myimage:v1'. Which admission controller will first reject this Pod?

Accepted Answer

ValidatingAdmissionWebhook. OPA/Gatekeeper enforces policies via ValidatingAdmissionWebhooks, which intercept admission requests and validate them against constraints. When a Pod with image 'gcr.io/myimage:v1' is created, the ValidatingAdmissionWebhook (C) processes the request, checks the constraint requiring images from a specific registry, and rejects the Pod if the image does not match. This is the correct admission controller because Gatekeeper uses ValidatingAdmissionWebhooks to enforce its constraint templates.

Answer

PodSecurity

Answer

ImagePolicyWebhook

Answer

MutatingAdmissionWebhook

Question 20

Which command would scan a Kubernetes Pod manifest for security issues?

Accepted Answer

checkov -f pod.yaml. Both A and D are correct because `checkov -f pod.yaml` and `kubesec scan pod.yaml` are static analysis tools that scan Kubernetes YAML manifests for security misconfigurations such as privileged containers, hostNetwork access, and violations of Pod Security Standards. Checkov is a general IaC scanner supporting Kubernetes, while kubesec is specialized for Kubernetes resources. Options B and C are incorrect: `trivy image` scans container images for vulnerabilities, not manifest files, and `cosign verify` verifies container image signatures. Thus, A and D are valid commands for scanning a Pod manifest.

Answer

trivy image pod.yaml

Answer

cosign verify pod.yaml