CKS Supply Chain Security Practice Test 10 — 15 Questions

Question 1

A security admin wants to ensure that only images signed with a specific key can run in the cluster. Which admission controller should be enabled?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows a cluster to enforce that only container images signed with a specific key can run. It intercepts pod creation requests and queries an external webhook to verify the image signature before admitting the pod. This directly meets the requirement of restricting execution to signed images.

Answer

PodSecurityPolicy

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Question 2

A developer creates a Dockerfile with 'FROM ubuntu:latest'. The security team recommends using a minimal base image. Which change minimizes the attack surface?

Accepted Answer

FROM gcr.io/distroless/base:latest. The `gcr.io/distroless/base:latest` image is a minimal, language-specific base image that contains only the essential runtime dependencies (e.g., glibc, libssl) and no package manager, shell, or utilities. This drastically reduces the attack surface by eliminating unnecessary binaries and tools that could be exploited. In contrast, `ubuntu:latest` includes a full userland with apt, bash, and other utilities, increasing the potential for privilege escalation or supply chain attacks.

Answer

FROM alpine:latest

Answer

FROM scratch

Answer

FROM ubuntu:20.04

Question 3

An admin runs 'kubectl run nginx --image=nginx' and the pod fails with 'ImagePullBackOff'. The cluster has an OPA/Gatekeeper constraint that only allows images from 'myregistry.io'. How can the admin quickly test the restriction?

Accepted Answer

Use an image from 'myregistry.io/nginx:latest'. The OPA/Gatekeeper constraint explicitly restricts allowed images to those from 'myregistry.io'. By specifying an image from that registry (e.g., 'myregistry.io/nginx:latest'), the admin can quickly verify that the constraint permits compliant images. This tests the policy's intended behavior without altering or bypassing the constraint.

Answer

Delete the OPA constraint

Answer

Add a label 'allowlist=true' to the pod

Answer

Use 'kubectl run nginx --image=nginx --validate=false'

Question 4

Which tool can generate an SBOM (Software Bill of Materials) from a container image?

Accepted Answer

syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to extract package metadata from package managers (e.g., dpkg, RPM, APK) and produces SBOMs in formats like SPDX and CycloneDX, directly addressing the requirement for supply chain transparency.

Answer

kubesec

Answer

trivy

Answer

checkov

Question 5

A security audit reveals that a Deployment uses an image with a mutable tag 'app:latest'. Which change ensures the image is immutable and traceable?

Accepted Answer

Use 'image: app@sha256:abc123...'. Using the image digest (e.g., `image: app@sha256:abc123...`) pins the container image to an immutable, content-addressable identifier. Unlike mutable tags, the digest is a cryptographic hash of the image manifest, ensuring that every pull returns the exact same image, which is critical for traceability and supply chain security.

Answer

Change tag to 'app:stable'

Answer

Set 'replicas: 1'

Answer

Add 'imagePullPolicy: Always'

Question 6

Which kubectl command signs a container image using Cosign?

Accepted Answer

cosign sign myimage:latest. Cosign is a standalone tool for signing and verifying container images, not a kubectl subcommand. The correct command is `cosign sign myimage:latest`, which signs the image and stores the signature in an OCI-compliant registry alongside the image. This is part of the supply chain security workflow for ensuring image integrity and provenance.

Answer

crictl sign myimage:latest

Answer

kubectl sign image myimage:latest

Answer

kubectl cosign sign myimage:latest

Question 7

Which YAML field in a Deployment specifies the container user should not run as root?

Accepted Answer

spec.containers[].securityContext.runAsNonRoot. `spec.containers[].securityContext.runAsNonRoot: true` explicitly enforces that the container's user ID is non-zero, preventing the container from running as root. This is a key Pod Security Standard (PSS) control for the 'Restricted' profile, ensuring compliance with the principle of least privilege. The field rejects the container if the user is set to root (UID 0) or if no user is specified and the image defaults to root.

Answer

spec.containers[].securityContext.readOnlyRootFilesystem

Answer

spec.containers[].securityContext.runAsUser: 0

Answer

spec.containers[].securityContext.allowPrivilegeEscalation

Question 8

A cluster uses Kyverno to enforce that all images come from a trusted registry. A new Deployment fails with a message that the image 'docker.io/library/nginx:latest' is not allowed. What Kyverno policy rule likely caused this?

Accepted Answer

A validate rule that checks the image registry. Kyverno uses validate rules to enforce policies by checking resource attributes against defined conditions. The error message indicates that the image 'docker.io/library/nginx:latest' was rejected because it does not come from a trusted registry. A validate rule with a pattern or deny condition that inspects the image field (e.g., `spec.containers[*].image`) and restricts it to a specific registry prefix (like `trusted-registry.io/*`) would cause this rejection.

Answer

A validate rule that checks the container's resource limits

Answer

A generate rule that creates a ConfigMap

Answer

A mutating rule that adds a label to the pod

Question 9

To verify a signed container image, which command should be used?

Accepted Answer

cosign verify myimage:latest. The `cosign verify` command is the correct tool for verifying the cryptographic signature of a signed container image stored in an OCI-compliant registry. Cosign, part of the Sigstore project, uses public-key or keyless signing to ensure image integrity and authenticity. The command checks the signature against the image manifest and the provided public key or Fulcio certificate, confirming that the image has not been tampered with since signing.

Answer

trivy verify myimage:latest

Answer

kubectl verify myimage:latest

Answer

cosign validate myimage:latest

Question 10

Which TWO practices improve supply chain security for container images? (Select two.)

Accepted Answer

Scanning images for CVEs before deployment. Scanning images for CVEs before deployment is a core supply chain security practice because it identifies known vulnerabilities in the base image and installed packages before the container enters production. Tools like Trivy, Grype, or Clair compare the image's package inventory against vulnerability databases (e.g., NVD, OSV), allowing teams to reject or patch images with critical flaws. This proactive measure prevents attackers from exploiting unpatched software in the runtime environment.

Answer

Storing secrets in the Dockerfile

Answer

Using the 'latest' tag for easy updates

Answer

Running containers as root

Question 11

Which THREE are valid admission controllers in Kubernetes? (Select three.)

Accepted Answer

ImagePolicyWebhook. ImagePolicyWebhook is a valid admission controller that allows an external webhook to validate container images against a policy before they are admitted into the cluster. It is part of Kubernetes' supply chain security controls, enabling checks such as image signature verification or registry allowlisting.

Answer

ServiceAccount

Answer

NetworkPolicy

Question 12

Which TWO tools can generate an SBOM for a container image? (Select two.)

Accepted Answer

trivy. Trivy is a comprehensive vulnerability scanner that can generate an SBOM (Software Bill of Materials) for container images using its `trivy image --format cyclonedx` or `trivy image --format spdx` commands, outputting in CycloneDX or SPDX formats. Syft is a dedicated SBOM generation tool from Anchore that produces detailed SBOMs from container images using `syft packages <image>` and supports multiple output formats including CycloneDX and SPDX. Both tools are specifically designed to inventory all software components within a container image, making them correct choices for SBOM generation.

Answer

checkov

Answer

cosign

Answer

kubesec

Question 13

A security team wants to ensure that all container images in a cluster are scanned for critical CVEs before they are run. They decide to use an admission controller. Which Kubernetes built-in admission controller should they configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is the correct choice because it allows an external webhook to validate container images against a policy (e.g., scanning for critical CVEs) before they are admitted into the cluster. It intercepts Pod creation requests and queries an external service to decide whether the image is allowed, making it ideal for enforcing image security scanning at admission time.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionPolicy

Answer

PodSecurity

Question 14

A developer runs 'trivy image myapp:latest' and gets a report with several CRITICAL CVEs. Which action would BEST address the supply chain security risk?

Accepted Answer

Rebuild the image using a minimal base image like distroless or alpine with no CVEs. Rebuilding the image using a minimal base image like distroless or Alpine directly eliminates the vulnerable packages that cause the CRITICAL CVEs. This addresses the root cause of the supply chain risk by ensuring the container image contains only the necessary runtime dependencies, reducing the attack surface and removing known vulnerabilities at the source.

Answer

Ignore the report because the container is running in a sandboxed environment

Answer

Run 'trivy image myapp:latest --severity CRITICAL' to filter out lower severity findings

Answer

Add a network policy to block outbound traffic from the container

Question 15

An administrator wants to enforce that only images signed by a trusted key can run in the cluster. They have configured cosign and want to use a Kubernetes admission controller. Which tool should they deploy?

Accepted Answer

Kyverno with a verifyImages rule. Kyverno is a Kubernetes-native policy engine that can enforce admission controls via policies. Its `verifyImages` rule uses Cosign to check that container images are signed with a trusted public key before allowing them to run, making it the correct tool for this use case.

Answer

Helm

Answer

Kube-bench

Answer

Prometheus