CKS Supply Chain Security Practice Test 11 — 15 Questions

Question 1

What is the purpose of an SBOM (Software Bill of Materials) in the context of supply chain security?

Accepted Answer

To provide a list of all software components and dependencies in an artifact. An SBOM is a formal, machine-readable inventory of all software components, libraries, and dependencies that make up an artifact such as a container image. Its purpose is to provide transparency into the supply chain so that when a new vulnerability is disclosed, you can quickly determine whether your artifact contains the affected component. It does not itself perform signing, scanning, or runtime enforcement.

Answer

To sign container images

Answer

To scan images for vulnerabilities

Answer

To enforce runtime security policies

Question 2

Which command would you use to sign a container image with Cosign?

Accepted Answer

cosign sign . The `cosign sign ` command is used to sign a container image with Cosign, attaching a digital signature to the image manifest in the container registry. This signature can later be verified to ensure the image's integrity and origin, which is a core requirement for supply chain security in Kubernetes environments.

Answer

cosign push <image>

Answer

cosign verify <image>

Answer

cosign attest <image>

Question 3

You run 'trivy image myapp:latest' and the scan reports several critical CVEs. What is the best action to take?

Accepted Answer

Rebuild the image with updated base images and re-deploy. Rebuilding the image with updated base images directly addresses the root cause of the CVEs—outdated or vulnerable packages in the container image. After rebuilding, you must re-deploy the updated image to replace the running vulnerable containers. This aligns with the supply chain security principle of maintaining a secure software bill of materials (SBOM) and ensuring images are patched against known vulnerabilities before deployment.

Answer

Use kubectl delete pod to remove the running container

Answer

Delete the image from the registry

Answer

Ignore the CVEs because the image is running in a non-production environment

Question 4

A security engineer wants to ensure that all container images in a Kubernetes cluster have a non-root user. Which admission controller can enforce this requirement?

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that can enforce custom admission control rules, such as requiring containers to run as a non-root user. Unlike deprecated or built-in controllers, Kyverno allows you to define fine-grained policies (e.g., `autogen-check`) that validate or mutate Pod specs to ensure `runAsNonRoot: true` or `runAsUser: >0`.

Answer

ServiceAccount

Answer

PodSecurityPolicy (deprecated)

Answer

NodeRestriction

Question 5

What is the correct way to specify a container image using a SHA digest instead of a tag for immutable deployments?

Accepted Answer

image: myapp@sha256:abc123.... Using the `@sha256:` syntax pins the container image to an immutable content digest, ensuring that every pull returns the exact same image regardless of tag updates. This eliminates the risk of tag mutability, where a tag like `latest` can be overwritten with a different image, breaking supply chain integrity and reproducibility.

Answer

image: myapp:latest

Answer

image: myapp:stable

Answer

image: myapp:1.0.0

Question 6

Which static analysis tool can be used to check Kubernetes manifests for security misconfigurations?

Accepted Answer

kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes YAML manifests against a set of security best practices, such as ensuring containers run as non-root, enforcing read-only root filesystems, and dropping unnecessary Linux capabilities. It outputs a risk score and highlights misconfigurations without requiring a running cluster, making it ideal for early detection in CI/CD pipelines.

Answer

kubectl apply

Answer

trivy image

Answer

helm template

Question 7

In a CI/CD pipeline, at which stage should container image scanning be performed?

Accepted Answer

After building the image but before pushing to registry. Container image scanning should be performed after building the image but before pushing it to the registry (Option D). This ensures that vulnerabilities are detected before the image is stored and distributed, preventing insecure images from being deployed. Scanning at this stage integrates security into the CI/CD pipeline, allowing teams to fail the build or trigger remediation before the image reaches production.

Answer

Only when a vulnerability is reported

Answer

After deployment to production

Answer

Before code commit

Question 8

Which TWO of the following are valid admission controllers in Kubernetes? (Select TWO)

Accepted Answer

MutatingAdmissionWebhook. MutatingAdmissionWebhook, is a valid admission controller that intercepts API requests and can modify them before they are persisted. It is part of the dynamic admission control mechanism, allowing external webhooks to mutate objects. Option C, ImagePolicyWebhook, is also a valid admission controller that enforces image policy checks by querying an external webhook before admitting a pod, making it a key component for supply chain security.

Answer

PodSecurityPolicy

Answer

AdmissionReview

Answer

OPA

Question 9

Which TWO of the following are tools for image signing and verification? (Select TWO)

Accepted Answer

Cosign. Cosign is correct because it is a tool specifically designed for container image signing and verification, leveraging Sigstore's keyless signing capabilities and integration with OCI registries. It enables developers to sign images using ephemeral keys and verify signatures against transparency logs, ensuring supply chain integrity.

Answer

Trivy

Answer

kubesec

Answer

Syft

Question 10

Which command scans a Docker image for CVEs using Trivy?

Accepted Answer

trivy image myapp:latest. `trivy image` is the specific Trivy subcommand used to scan a container image for vulnerabilities (CVEs). Trivy does not have a `cve`, `check`, or `scan` subcommand; the correct syntax is `trivy image <image-name>`.

Answer

trivy cve myapp:latest

Answer

trivy check myapp:latest

Answer

trivy scan myapp:latest

Question 11

A security admin wants to ensure that only images signed with a specific key can run in the cluster. Which admission controller should be enabled?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows a cluster to enforce that only container images signed with a specific key can run. It intercepts pod creation requests and queries an external webhook to verify the image signature before admitting the pod. This directly meets the requirement of restricting execution to signed images.

Answer

PodSecurityPolicy

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Question 12

A developer creates a Dockerfile with 'FROM ubuntu:latest'. The security team recommends using a minimal base image. Which change minimizes the attack surface?

Accepted Answer

FROM gcr.io/distroless/base:latest. The `gcr.io/distroless/base:latest` image is a minimal, language-specific base image that contains only the essential runtime dependencies (e.g., glibc, libssl) and no package manager, shell, or utilities. This drastically reduces the attack surface by eliminating unnecessary binaries and tools that could be exploited. In contrast, `ubuntu:latest` includes a full userland with apt, bash, and other utilities, increasing the potential for privilege escalation or supply chain attacks.

Answer

FROM alpine:latest

Answer

FROM scratch

Answer

FROM ubuntu:20.04

Question 13

An admin runs 'kubectl run nginx --image=nginx' and the pod fails with 'ImagePullBackOff'. The cluster has an OPA/Gatekeeper constraint that only allows images from 'myregistry.io'. How can the admin quickly test the restriction?

Accepted Answer

Use an image from 'myregistry.io/nginx:latest'. The OPA/Gatekeeper constraint explicitly restricts allowed images to those from 'myregistry.io'. By specifying an image from that registry (e.g., 'myregistry.io/nginx:latest'), the admin can quickly verify that the constraint permits compliant images. This tests the policy's intended behavior without altering or bypassing the constraint.

Answer

Delete the OPA constraint

Answer

Add a label 'allowlist=true' to the pod

Answer

Use 'kubectl run nginx --image=nginx --validate=false'

Question 14

A security audit reveals that a Deployment uses an image with a mutable tag 'app:latest'. Which change ensures the image is immutable and traceable?

Accepted Answer

Use 'image: app@sha256:abc123...'. Using the image digest (e.g., `image: app@sha256:abc123...`) pins the container image to an immutable, content-addressable identifier. Unlike mutable tags, the digest is a cryptographic hash of the image manifest, ensuring that every pull returns the exact same image, which is critical for traceability and supply chain security.

Answer

Change tag to 'app:stable'

Answer

Set 'replicas: 1'

Answer

Add 'imagePullPolicy: Always'

Question 15

Which YAML field in a Deployment specifies the container user should not run as root?

Accepted Answer

spec.containers[].securityContext.runAsNonRoot. `spec.containers[].securityContext.runAsNonRoot: true` explicitly enforces that the container's user ID is non-zero, preventing the container from running as root. This is a key Pod Security Standard (PSS) control for the 'Restricted' profile, ensuring compliance with the principle of least privilege. The field rejects the container if the user is set to root (UID 0) or if no user is specified and the image defaults to root.

Answer

spec.containers[].securityContext.readOnlyRootFilesystem

Answer

spec.containers[].securityContext.runAsUser: 0

Answer

spec.containers[].securityContext.allowPrivilegeEscalation