CKS Supply Chain Security Practice Test 11 — 15 Questions

Question 1

A Kubernetes cluster has Kyverno installed. You want to enforce that all container images come from a trusted registry 'trusted-registry.example.com'. Which Kyverno policy rule type would you use?

Accepted Answer

validate with a deny condition. Kyverno's `validate` rule type with a `deny` condition is specifically designed to reject resources that violate a policy. In this case, the policy would deny any Pod that references an image not matching the pattern `trusted-registry.example.com/*`, enforcing the trusted registry requirement at admission time.

Answer

mutate

Answer

validate.deny

Answer

generate

Question 2

Which of the following is a BEST practice for securing container images in a Dockerfile?

Accepted Answer

Use the USER directive to specify a non-root user. The USER directive in a Dockerfile sets the user for the container process, and using a non-root user (e.g., USER 1000) follows the principle of least privilege. This reduces the attack surface by preventing an attacker who gains code execution from having root access to the host or container, which is a critical security requirement for containerized workloads.

Answer

Store secrets in environment variables in the image

Answer

Run the container as root to simplify permission management

Answer

Use the 'latest' tag to always get the newest base image

Question 3

A CI pipeline uses 'checkov' to scan Kubernetes manifests. Which of the following is a common checkov check related to supply chain security?

Accepted Answer

CKV_K8S_3: Ensure that the image is signed. Checkov rule CKV_K8S_3 specifically checks that container images are signed, which directly addresses supply chain security by verifying image integrity and origin. In a CI pipeline, this helps prevent the deployment of tampered or unauthorized images, a key concern for supply chain attacks.

Answer

CKV_K8S_2: Ensure that the container has a read-only root filesystem

Answer

CKV_K8S_4: Ensure that the container uses a non-root user

Answer

CKV_K8S_1: Pod Security Policy

Question 4

A pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient memory.' The pod YAML does not specify any tolerations. Which command would allow the pod to schedule on the control-plane node?

Accepted Answer

Edit the pod YAML to add tolerations for node-role.kubernetes.io/control-plane. The pod is failing to schedule on the control-plane node due to the `node-role.kubernetes.io/control-plane` taint, which by default prevents pods without a matching toleration from being scheduled. Since the pod YAML does not specify any tolerations, editing it to add a toleration for that taint (e.g., `tolerations: - key: node-role.kubernetes.io/control-plane operator: Exists`) explicitly allows the pod to run on the control-plane node, resolving the Pending state.

Answer

kubectl taint nodes control-plane node-role.kubernetes.io/control-plane-

Answer

kubectl cordon control-plane

Answer

kubectl delete pod --all

Question 5

You need to sign a container image using cosign with a key stored in an environment variable. Which command should you use?

Accepted Answer

cosign sign --key env://COSIGN_PRIVATE_KEY myimage:latest. `cosign sign --key env://COSIGN_PRIVATE_KEY` instructs Cosign to read the private key from the environment variable named `COSIGN_PRIVATE_KEY` using the `env://` URI scheme. This is the standard way to reference a key stored in an environment variable, avoiding exposure on the command line or in files.

Answer

cosign sign myimage:latest --key cosign.pub

Answer

cosign sign --key $COSIGN_PRIVATE_KEY myimage:latest

Answer

cosign sign --key file://cosign.key myimage:latest

Question 6

What is the primary purpose of an SBOM in supply chain security?

Accepted Answer

To list all open source and third-party components in an image. An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of all components—including open source and third-party libraries—used to build a software artifact. In supply chain security, its primary purpose is to provide transparency and enable vulnerability tracking by listing every dependency, so that when a new CVE is disclosed, teams can quickly determine if their images are affected. This aligns directly with option A.

Answer

To scan images for secrets

Answer

To sign container images

Answer

To enforce network policies

Question 7

You have a Kyverno policy that validates images are from a specific registry. However, a pod using an image from that registry is still blocked. The pod YAML includes 'imagePullPolicy: Always'. What could be the issue?

Accepted Answer

The pod uses a different registry name than the one in the policy (e.g., a mirror). Kyverno validates the image registry against the exact string specified in the policy. If the pod references an image from a mirror (e.g., `myregistry.io/nginx` instead of `myregistry.io/nginx`), or if the registry name differs (e.g., `docker.io` vs `registry-1.docker.io`), the validation fails even though the actual image content may be identical. The `imagePullPolicy: Always` is irrelevant to the registry check; it only affects when the kubelet pulls the image.

Answer

The imagePullPolicy is set to Always, causing Kyverno to ignore the registry check

Answer

Kyverno cannot validate images with a tag

Answer

The policy is missing the 'validate' rule type

Question 8

Which TWO of the following are valid ways to verify a container image signature using cosign?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. `cosign verify-attestation --key cosign.pub myimage:latest` validates an in-toto attestation attached to a container image using a public key, which is a valid method to verify the image's provenance and integrity. Option E is correct because `cosign verify --key cosign.pub myimage:latest` directly verifies the container image's signature against the provided public key, confirming the image was signed by the holder of the corresponding private key.

Answer

cosign validate myimage:latest

Answer

cosign check myimage:latest

Answer

cosign attest --key cosign.key myimage:latest

Question 9

Which TWO of the following are best practices for securing the software supply chain in a CI/CD pipeline?

Accepted Answer

Scan all container images for known vulnerabilities before deployment. Scanning container images for known vulnerabilities (e.g., using Trivy, Clair, or Grype) before deployment is a fundamental supply chain security practice. It ensures that only images free of critical or high-severity CVEs are promoted to production, reducing the attack surface and preventing exploitation of known flaws.

Answer

Use the 'latest' tag for base images to get the newest features

Answer

Store sensitive credentials directly in the pipeline YAML file

Answer

Ignore critical CVEs if they are in development environments

Question 10

Which THREE of the following are valid approaches to prevent containers from running as root in a Kubernetes cluster?

Accepted Answer

Use Pod Security Admission with the 'restricted' profile. Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces Pod Security Standards (PSS). The 'restricted' profile, as defined in the Kubernetes documentation, requires that containers run with `runAsNonRoot: true`, preventing root execution at the admission level without needing external tools.

Answer

Set the container's entrypoint to 'sudo'

Answer

Use a Seccomp profile that blocks root system calls

Question 11

Which THREE of the following are tools used for static analysis of Kubernetes manifests?

Accepted Answer

kubesec. A. kubesec is correct because it performs static analysis of Kubernetes manifests by evaluating YAML/JSON configurations against a set of security best practices, such as ensuring containers run as non-root, read-only root filesystems, and dropping all capabilities. It outputs a score and a list of recommendations without actually deploying the resources, making it a pure static analysis tool.

Answer

trivy

Answer

syft

Question 12

A security team wants to ensure that only container images from a trusted registry (mytrustedregistry.io) are deployed in the cluster. They plan to use OPA/Gatekeeper. Which kind of Gatekeeper constraint template and constraint should they create?

Accepted Answer

A constraint that uses a pattern to match the image field against allowed registries. OPA/Gatekeeper enforces policies via constraint templates that define Rego rules. To restrict container images to a trusted registry, you create a constraint template that inspects the `spec.containers[*].image` field in the Pod spec and uses a pattern (e.g., regex or prefix match) to ensure the image string starts with `mytrustedregistry.io/`. The constraint then applies this template to the cluster, rejecting any Pod that references an image from an untrusted registry.

Answer

A constraint that validates the cluster's registry mirror configuration

Answer

A constraint that inspects the image field in the Pod's metadata annotations

Answer

A constraint that checks the imagePullSecrets field in the Pod spec

Question 13

A developer wants to verify the signature of a container image before deploying it. Which command should they use along with Cosign?

Accepted Answer

cosign verify. The `cosign verify` command is used to check the cryptographic signature of a container image against a public key, ensuring the image's integrity and authenticity. This is the correct tool for a developer who needs to confirm that the image has not been tampered with and was signed by a trusted entity before deployment.

Answer

cosign generate-key-pair

Answer

cosign sign

Answer

cosign attest

Question 14

During a CI/CD pipeline, you run 'trivy image myapp:latest' and get a high number of vulnerabilities. What is the BEST action to reduce the vulnerability count?

Accepted Answer

Switch to a distroless base image. Distroless base images contain only the essential runtime dependencies (e.g., glibc, libssl) and exclude package managers, shells, and other utilities that are common sources of CVEs. By switching to a distroless image, you drastically reduce the attack surface and the number of packages that Trivy scans, directly lowering the vulnerability count without changing application code.

Answer

Increase CPU and memory limits for the container

Answer

Sign the image with Cosign

Answer

Remove all environment variables from the Dockerfile

Question 15

A security policy requires that all container images must reference a specific SHA256 digest instead of a tag. You need to enforce this using Kyverno. Which Kyverno rule type and pattern would you use?

Accepted Answer

A validate rule with a pattern that the image field matches '@sha256:'. Kyverno's validate rules with a pattern can enforce that the image field in a Pod spec contains '@sha256:', ensuring only digest-based references are used. This directly meets the security policy requirement without altering the image reference or relying on external data.

Answer

A generate rule that creates a ConfigMap with allowed digests

Answer

A mutate rule that replaces the image tag with a digest

Answer

A validate rule checking the annotation 'image.openshift.io/triggers'