CKS Supply Chain Security Practice Test 12 — 15 Questions

Question 1

A cluster uses Kyverno to enforce that all images come from a trusted registry. A new Deployment fails with a message that the image 'docker.io/library/nginx:latest' is not allowed. What Kyverno policy rule likely caused this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A validate rule that checks the image registry. Kyverno uses validate rules to enforce policies by checking resource attributes against defined conditions. The error message indicates that the image 'docker.io/library/nginx:latest' was rejected because it does not come from a trusted registry. A validate rule with a pattern or deny condition that inspects the image field (e.g., `spec.containers[*].image`) and restricts it to a specific registry prefix (like `trusted-registry.io/*`) would cause this rejection.

Answer

A validate rule that checks the container's resource limits

Answer

A generate rule that creates a ConfigMap

Answer

A mutating rule that adds a label to the pod

Question 2

To verify a signed container image, which command should be used?

Accepted Answer

cosign verify myimage:latest. The `cosign verify` command is the correct tool for verifying the cryptographic signature of a signed container image stored in an OCI-compliant registry. Cosign, part of the Sigstore project, uses public-key or keyless signing to ensure image integrity and authenticity. The command checks the signature against the image manifest and the provided public key or Fulcio certificate, confirming that the image has not been tampered with since signing.

Answer

trivy verify myimage:latest

Answer

kubectl verify myimage:latest

Answer

cosign validate myimage:latest

Question 3

Which static analysis tool is specifically designed to evaluate Kubernetes manifests against security best practices?

Accepted Answer

kubesec. kubesec is a static analysis tool specifically designed to scan Kubernetes manifests and identify security risks, such as running containers as root, missing resource limits, or privileged mode. It evaluates YAML files against a set of security best practices and assigns a risk score. This makes it the correct tool for evaluating Kubernetes manifests against security best practices.

Answer

cosign

Answer

syft

Answer

clair

Question 4

In a CI/CD pipeline, which step is MOST effective for detecting known vulnerabilities in a container image before deployment?

Accepted Answer

Run a vulnerability scan on the container image. Running a vulnerability scan on the container image (Option A) is the most effective step because it directly checks the image layers and installed packages against known Common Vulnerabilities and Exposures (CVEs) databases, such as the National Vulnerability Database (NVD). This identifies security flaws in base images and dependencies before deployment, which is a core requirement of supply chain security in Kubernetes.

Answer

Check the image size

Answer

Run unit tests on the application code

Answer

Lint the Dockerfile

Question 5

Which TWO practices improve supply chain security for container images? (Select two.)

Accepted Answer

Scanning images for CVEs before deployment. Scanning images for CVEs before deployment is a core supply chain security practice because it identifies known vulnerabilities in the base image and installed packages before the container enters production. Tools like Trivy, Grype, or Clair compare the image's package inventory against vulnerability databases (e.g., NVD, OSV), allowing teams to reject or patch images with critical flaws. This proactive measure prevents attackers from exploiting unpatched software in the runtime environment.

Answer

Storing secrets in the Dockerfile

Answer

Using the 'latest' tag for easy updates

Answer

Running containers as root

Question 6

Which TWO tools can generate an SBOM for a container image? (Select two.)

Accepted Answer

trivy. Trivy is a comprehensive vulnerability scanner that can generate an SBOM (Software Bill of Materials) for container images using its `trivy image --format cyclonedx` or `trivy image --format spdx` commands, outputting in CycloneDX or SPDX formats. Syft is a dedicated SBOM generation tool from Anchore that produces detailed SBOMs from container images using `syft packages <image>` and supports multiple output formats including CycloneDX and SPDX. Both tools are specifically designed to inventory all software components within a container image, making them correct choices for SBOM generation.

Answer

checkov

Answer

cosign

Answer

kubesec

Question 7

A security team wants to ensure that all container images in a cluster are scanned for critical CVEs before they are run. They decide to use an admission controller. Which Kubernetes built-in admission controller should they configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is the correct choice because it allows an external webhook to validate container images against a policy (e.g., scanning for critical CVEs) before they are admitted into the cluster. It intercepts Pod creation requests and queries an external service to decide whether the image is allowed, making it ideal for enforcing image security scanning at admission time.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionPolicy

Answer

PodSecurity

Question 8

A developer runs 'trivy image myapp:latest' and gets a report with several CRITICAL CVEs. Which action would BEST address the supply chain security risk?

Accepted Answer

Rebuild the image using a minimal base image like distroless or alpine with no CVEs. Rebuilding the image using a minimal base image like distroless or Alpine directly eliminates the vulnerable packages that cause the CRITICAL CVEs. This addresses the root cause of the supply chain risk by ensuring the container image contains only the necessary runtime dependencies, reducing the attack surface and removing known vulnerabilities at the source.

Answer

Ignore the report because the container is running in a sandboxed environment

Answer

Run 'trivy image myapp:latest --severity CRITICAL' to filter out lower severity findings

Answer

Add a network policy to block outbound traffic from the container

Question 9

An administrator wants to enforce that only images signed by a trusted key can run in the cluster. They have configured cosign and want to use a Kubernetes admission controller. Which tool should they deploy?

Accepted Answer

Kyverno with a verifyImages rule. Kyverno is a Kubernetes-native policy engine that can enforce admission controls via policies. Its `verifyImages` rule uses Cosign to check that container images are signed with a trusted public key before allowing them to run, making it the correct tool for this use case.

Answer

Helm

Answer

Kube-bench

Answer

Prometheus

Question 10

A Kubernetes cluster has Kyverno installed. You want to enforce that all container images come from a trusted registry 'trusted-registry.example.com'. Which Kyverno policy rule type would you use?

Accepted Answer

validate with a deny condition. Kyverno's `validate` rule type with a `deny` condition is specifically designed to reject resources that violate a policy. In this case, the policy would deny any Pod that references an image not matching the pattern `trusted-registry.example.com/*`, enforcing the trusted registry requirement at admission time.

Answer

mutate

Answer

validate.deny

Answer

generate

Question 11

Which of the following is a BEST practice for securing container images in a Dockerfile?

Accepted Answer

Use the USER directive to specify a non-root user. The USER directive in a Dockerfile sets the user for the container process, and using a non-root user (e.g., USER 1000) follows the principle of least privilege. This reduces the attack surface by preventing an attacker who gains code execution from having root access to the host or container, which is a critical security requirement for containerized workloads.

Answer

Store secrets in environment variables in the image

Answer

Run the container as root to simplify permission management

Answer

Use the 'latest' tag to always get the newest base image

Question 12

A pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient memory.' The pod YAML does not specify any tolerations. Which command would allow the pod to schedule on the control-plane node?

Accepted Answer

Edit the pod YAML to add tolerations for node-role.kubernetes.io/control-plane. The pod is failing to schedule on the control-plane node due to the `node-role.kubernetes.io/control-plane` taint, which by default prevents pods without a matching toleration from being scheduled. Since the pod YAML does not specify any tolerations, editing it to add a toleration for that taint (e.g., `tolerations: - key: node-role.kubernetes.io/control-plane operator: Exists`) explicitly allows the pod to run on the control-plane node, resolving the Pending state.

Answer

kubectl taint nodes control-plane node-role.kubernetes.io/control-plane-

Answer

kubectl cordon control-plane

Answer

kubectl delete pod --all

Question 13

You need to sign a container image using cosign with a key stored in an environment variable. Which command should you use?

Accepted Answer

cosign sign --key env://COSIGN_PRIVATE_KEY myimage:latest. `cosign sign --key env://COSIGN_PRIVATE_KEY` instructs Cosign to read the private key from the environment variable named `COSIGN_PRIVATE_KEY` using the `env://` URI scheme. This is the standard way to reference a key stored in an environment variable, avoiding exposure on the command line or in files.

Answer

cosign sign myimage:latest --key cosign.pub

Answer

cosign sign --key $COSIGN_PRIVATE_KEY myimage:latest

Answer

cosign sign --key file://cosign.key myimage:latest

Question 14

What is the primary purpose of an SBOM in supply chain security?

Accepted Answer

To list all open source and third-party components in an image. An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of all components—including open source and third-party libraries—used to build a software artifact. In supply chain security, its primary purpose is to provide transparency and enable vulnerability tracking by listing every dependency, so that when a new CVE is disclosed, teams can quickly determine if their images are affected. This aligns directly with option A.

Answer

To scan images for secrets

Answer

To sign container images

Answer

To enforce network policies

Question 15

Which TWO of the following are valid ways to verify a container image signature using cosign?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. `cosign verify-attestation --key cosign.pub myimage:latest` validates an in-toto attestation attached to a container image using a public key, which is a valid method to verify the image's provenance and integrity. Option E is correct because `cosign verify --key cosign.pub myimage:latest` directly verifies the container image's signature against the provided public key, confirming the image was signed by the holder of the corresponding private key.

Answer

cosign validate myimage:latest

Answer

cosign check myimage:latest

Answer

cosign attest --key cosign.key myimage:latest