CKS Supply Chain Security Practice Test 10 — 15 Questions

Question 1

You have a Kyverno policy that validates image registries. The policy should allow only images from `myregistry.example.com`. Which Kyverno rule field should be used to check the image registry?

Accepted Answer

imageRegistry. The `imageRegistry` field in a Kyverno policy rule is specifically designed to validate image registries by matching the registry hostname against a pattern. In this case, setting `imageRegistry: "myregistry.example.com/*"` ensures only images from that registry are allowed, blocking others at admission time.

Answer

mutate

Answer

resources

Answer

generate

Question 2

Which of the following is a best practice for Dockerfiles to improve supply chain security?

Accepted Answer

Use a distroless base image. Distroless base images contain only the application and its runtime dependencies, significantly reducing the attack surface by eliminating package managers, shells, and other utilities that could be exploited. This aligns with the principle of minimalism in supply chain security, as fewer components mean fewer potential vulnerabilities and a smaller blast radius in case of compromise.

Answer

Use the latest tag for base images to get the newest features

Answer

Run the container as root by default

Answer

Hardcode secrets directly in the Dockerfile

Question 3

A DevOps team wants to enforce that all Deployments must have a specific label 'app.kubernetes.io/name'. Which tool can be used to validate this in the admission controller stage?

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that can validate, mutate, and generate resources using admission webhooks. It can enforce that all Deployments carry the label 'app.kubernetes.io/name' by defining a 'validate' rule in a ClusterPolicy, which checks the resource during the admission controller stage before it is persisted to etcd.

Answer

Trivy

Answer

Cosign

Answer

Syft

Question 4

What does SBOM stand for in the context of supply chain security?

Accepted Answer

Software Bill of Materials. SBOM stands for Software Bill of Materials. It is a formal, machine-readable inventory of all components, libraries, and dependencies used to build a software artifact. In supply chain security, an SBOM enables organizations to quickly identify and remediate vulnerabilities (e.g., Log4Shell) by tracking which versions of open-source or third-party components are included in a release.

Answer

Systematic Bug and Oversight Manager

Answer

Secure Build Orchestration Manager

Answer

Source Binary Object Model

Question 5

An admin wants to scan a local filesystem for vulnerabilities using Trivy. Which command should they use?

Accepted Answer

trivy fs. `trivy fs` scans a local filesystem for vulnerabilities, misconfigurations, and secrets. This command is specifically designed to analyze directories and files on disk, making it the appropriate choice for scanning a local filesystem as described in the question.

Answer

trivy image

Answer

trivy config

Answer

trivy repo

Question 6

Which tool can generate an SBOM for a container image?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) for container images and filesystems. It scans the image layers and package managers (e.g., APT, RPM, pip, npm) to produce an SBOM in formats like CycloneDX or SPDX, directly addressing the question's requirement.

Answer

Trivy

Answer

Cosign

Answer

Kubescape

Question 7

A cluster has the ImagePolicyWebhook admission controller enabled. A pod creation is denied with the message 'image policy check failed'. The webhook server returns an error. Which of the following could be a valid reason?

Accepted Answer

The image is not signed by a trusted authority. The ImagePolicyWebhook admission controller intercepts pod creation requests and queries an external webhook server to determine whether the image should be allowed. If the webhook returns an error (e.g., HTTP 5xx or a denial response), the admission controller fails the request with 'image policy check failed'. A common reason for the webhook to deny the request is that the image is not signed by a trusted authority, as the webhook may be configured to enforce image signature verification (e.g., using Notary or Sigstore).

Answer

The container runtime is out of date

Answer

The image tag does not exist in the registry

Answer

The pod specification has a hostNetwork: true

Question 8

Which Kubernetes admission controller ensures that a pod only uses images from a specific registry?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows you to define a webhook that validates container images against a policy, such as restricting them to a specific registry. When a pod is created, Kubernetes sends an admission review to the webhook, which can reject images not from the allowed registry. This is the correct choice because it directly enforces image source policies.

Answer

NamespaceLifecycle

Answer

PodNodeSelector

Answer

AlwaysPullImages

Question 9

Which TWO of the following are best practices for securing the container supply chain? (Select 2)

Accepted Answer

Scan container images for vulnerabilities. Using minimal base images reduces the attack surface, and scanning images for vulnerabilities helps identify and fix security issues before deployment.

Answer

Disable image pull secrets to reduce complexity

Answer

Hardcode secrets in the Dockerfile for convenience

Answer

Run containers as root to simplify permissions

Question 10

Which THREE of the following can be used to enforce policies on container images in a Kubernetes cluster? (Select 3)

Accepted Answer

Kyverno. Kyverno (A) is correct because it is a Kubernetes-native policy engine that runs as an admission controller and can validate, mutate, and generate resources, including enforcing rules on container images (e.g., allowed registries, required signatures, or tag restrictions) via ClusterPolicy/Policy resources. ImagePolicyWebhook (B) is correct because it is a built-in Kubernetes admission controller plugin that sends image admission requests to an external HTTP webhook, which can approve or reject pods based on image policy decisions. OPA/Gatekeeper (D) is correct because Gatekeeper deploys Open Policy Agent as a validating admission webhook in Kubernetes, using ConstraintTemplates and Constraints to enforce policies such as restricting container image registries or requiring trusted images. Trivy (C) is not correct here because it is a vulnerability and misconfiguration scanner for images and filesystems, not an admission-time policy enforcement mechanism. kubectl (E) is not correct because it is the Kubernetes command-line client for interacting with the API server, not a policy engine or admission controller.

Answer

Trivy

Answer

kubectl

Question 11

Which TWO of the following are valid methods to verify the integrity of a container image? (Select 2)

Accepted Answer

Compare the image SHA digest with a known good digest. Container images are identified by a content-addressable digest (SHA256 hash) that uniquely represents the image manifest. Verifying that the SHA digest of a pulled image matches a known good digest from a trusted source ensures the image has not been tampered with or altered in transit, as any change to the image layers or configuration would result in a different digest.

Answer

Use trivy image to check for vulnerabilities

Answer

Use docker history to view layers

Answer

Use kubectl describe pod to check image details

Question 12

You are implementing supply chain security for container images. Which tool would you use to scan a local directory of Dockerfiles and Kubernetes manifests for known vulnerabilities?

Accepted Answer

trivy fs. D is correct because `trivy fs` scans a local filesystem (including directories containing Dockerfiles and Kubernetes manifests) for known vulnerabilities. It parses these files, checks base images against vulnerability databases, and detects misconfigurations or CVEs. This tool is designed for supply chain security, covering both package vulnerabilities and infrastructure-as-code issues. The `fs` subcommand of trivy combines filesystem scanning with configuration analysis, making it suitable for the stated task.

Answer

kubectl scan

Answer

syft

Answer

cosign sign

Question 13

Which of the following is a best practice for securing container images in a Kubernetes environment?

Accepted Answer

Use minimal base images such as distroless or Alpine to reduce attack surface. Minimal base images like distroless or Alpine contain only the application and its runtime dependencies, drastically reducing the number of packages, libraries, and utilities that could contain vulnerabilities or be exploited post-compromise. Fewer components mean a smaller attack surface, faster pulls, and easier vulnerability management. This is a foundational CKS best practice for supply chain and runtime security.

Answer

Store secrets directly in the Dockerfile for convenience

Answer

Run containers as root to have full access to system resources

Answer

Use the latest tag for all base images to get the newest features

Question 14

You need to enforce that all images deployed in the cluster are signed by a trusted key. Which Kubernetes admission control mechanism would you use?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to enforce that container images are signed by a trusted key. It intercepts Pod creation requests and validates the image signatures against a configured webhook endpoint, rejecting unsigned or untrusted images. This directly addresses the requirement for supply chain security by ensuring only cryptographically verified images are deployed.

Answer

ResourceQuota

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Question 15

A cluster administrator wants to allow only images from a specific registry (e.g., 'myregistry.io') to be deployed in the cluster. Which tool can be used to enforce this via admission control?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is a Kubernetes admission controller that allows you to enforce custom policies, such as restricting container images to a specific registry. By defining a ConstraintTemplate and a Constraint that checks the image prefix (e.g., 'myregistry.io/'), Gatekeeper can reject any Pod creation that uses images from unauthorized registries. This directly addresses the requirement for registry-based admission control.

Answer

Helm

Answer

Calico

Answer

Prometheus