CKS Supply Chain Security Practice Test 12 — 15 Questions

Question 1

A security team wants to ensure that all container images in a cluster are scanned for critical CVEs before they are run. They decide to use an admission controller. Which Kubernetes built-in admission controller should they configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is the built-in mechanism that allows you to gate pod creation based on image policy decisions. The other options are not built-in admission controllers.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionPolicy

Answer

PodSecurity

Question 2

A developer runs 'trivy image myapp:latest' and gets a report with several CRITICAL CVEs. Which action would BEST address the supply chain security risk?

Accepted Answer

Rebuild the image using a minimal base image like distroless or alpine with no CVEs. The best practice is to rebuild the image using a minimal base image with no known vulnerabilities, reducing the attack surface.

Answer

Ignore the report because the container is running in a sandboxed environment

Answer

Run 'trivy image myapp:latest --severity CRITICAL' to filter out lower severity findings

Answer

Add a network policy to block outbound traffic from the container

Question 3

An administrator wants to enforce that only images signed by a trusted key can run in the cluster. They have configured cosign and want to use a Kubernetes admission controller. Which tool should they deploy?

Accepted Answer

Kyverno with a verifyImages rule. Cosign integrates with Kubernetes via the cosign webhook or through policy engines like Kyverno. Kyverno can verify image signatures using cosign.

Answer

Helm

Answer

Kube-bench

Answer

Prometheus

Question 4

You are asked to generate an SBOM for a container image and attach it as an attestation using cosign. Which two commands would you run in sequence?

Accepted Answer

syft myimage:latest -o spdx > sbom.spdx && cosign attest --type spdx --predicate sbom.spdx myimage:latest. First generate the SBOM with syft, then attach it as an attestation with cosign attest.

Answer

trivy image --format spdx myimage:latest > sbom.spdx && cosign verify --key cosign.pub myimage:latest

Answer

cosign sign --key cosign.key myimage:latest && syft myimage:latest -o spdx

Answer

crane ls myimage:latest && cosign attest --type spdx --predicate sbom.spdx myimage:latest

Question 5

A Kubernetes cluster has Kyverno installed. You want to enforce that all container images come from a trusted registry 'trusted-registry.example.com'. Which Kyverno policy rule type would you use?

Accepted Answer

validate with a deny condition. To validate the registry for container images, you use a validation rule that checks the image field.

Answer

mutate

Answer

validate.deny

Answer

generate

Question 6

Which of the following is a BEST practice for securing container images in a Dockerfile?

Accepted Answer

Use the USER directive to specify a non-root user. Using a non-root user in the container reduces the impact of a compromise. The other options are insecure or less effective.

Answer

Store secrets in environment variables in the image

Answer

Run the container as root to simplify permission management

Answer

Use the 'latest' tag to always get the newest base image

Question 7

A CI pipeline uses 'checkov' to scan Kubernetes manifests. Which of the following is a common checkov check related to supply chain security?

Accepted Answer

CKV_K8S_3: Ensure that the image is signed. Checkov includes checks for verifying image signatures as part of supply chain security.

Answer

CKV_K8S_2: Ensure that the container has a read-only root filesystem

Answer

CKV_K8S_4: Ensure that the container uses a non-root user

Answer

CKV_K8S_1: Pod Security Policy

Question 8

A pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient memory.' The pod YAML does not specify any tolerations. Which command would allow the pod to schedule on the control-plane node?

Accepted Answer

Edit the pod YAML to add tolerations for node-role.kubernetes.io/control-plane. To schedule on a control-plane node, you need to add a toleration for the node-role.kubernetes.io/control-plane taint. The other options are incorrect or incomplete.

Answer

kubectl taint nodes control-plane node-role.kubernetes.io/control-plane-

Answer

kubectl cordon control-plane

Answer

kubectl delete pod --all

Question 9

You need to sign a container image using cosign with a key stored in an environment variable. Which command should you use?

Accepted Answer

cosign sign --key env://COSIGN_PRIVATE_KEY myimage:latest. Cosign sign with --key env://[VAR] reads the key from an environment variable.

Answer

cosign sign myimage:latest --key cosign.pub

Answer

cosign sign --key $COSIGN_PRIVATE_KEY myimage:latest

Answer

cosign sign --key file://cosign.key myimage:latest

Question 10

What is the primary purpose of an SBOM in supply chain security?

Accepted Answer

To list all open source and third-party components in an image. An SBOM provides a list of all components in a software artifact, enabling vulnerability tracking and license compliance.

Answer

To scan images for secrets

Answer

To sign container images

Answer

To enforce network policies

Question 11

You have a Kyverno policy that validates images are from a specific registry. However, a pod using an image from that registry is still blocked. The pod YAML includes 'imagePullPolicy: Always'. What could be the issue?

Accepted Answer

The pod uses a different registry name than the one in the policy (e.g., a mirror). Kyverno matches against the exact image reference. If the registry is 'registry.example.com' but the pod uses 'docker.io/registry.example.com/image', the check fails.

Answer

The imagePullPolicy is set to Always, causing Kyverno to ignore the registry check

Answer

Kyverno cannot validate images with a tag

Answer

The policy is missing the 'validate' rule type

Question 12

Which TWO of the following are valid ways to verify a container image signature using cosign?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. Cosign verify and cosign verify-attestation are the correct commands. The other options are incorrect commands.

Answer

cosign validate myimage:latest

Answer

cosign check myimage:latest

Answer

cosign attest --key cosign.key myimage:latest

Question 13

Which TWO of the following are best practices for securing the software supply chain in a CI/CD pipeline?

Accepted Answer

Scan all container images for known vulnerabilities before deployment. Scanning images for vulnerabilities and signing images are key supply chain security practices. Storing secrets in the pipeline YAML is insecure, and ignoring critical CVEs is not a best practice.

Answer

Use the 'latest' tag for base images to get the newest features

Answer

Store sensitive credentials directly in the pipeline YAML file

Answer

Ignore critical CVEs if they are in development environments

Question 14

Which THREE of the following are valid approaches to prevent containers from running as root in a Kubernetes cluster?

Accepted Answer

Use Pod Security Admission with the 'restricted' profile. Pod Security Admission (PSA), OPA/Gatekeeper, and Kyverno are all valid tools to enforce security policies. Seccomp profiles restrict system calls but do not prevent running as root.

Answer

Set the container's entrypoint to 'sudo'

Answer

Use a Seccomp profile that blocks root system calls

Question 15

Which THREE of the following are tools used for static analysis of Kubernetes manifests?

Accepted Answer

kubesec. kubesec, checkov, and kube-score are static analysis tools. Trivy and Syft focus on container images and SBOMs.

Answer

trivy

Answer

syft