CKS Supply Chain Security Practice Test 12 — 15 Questions

Question 1

Which TWO of the following are valid methods to supply a Kubernetes manifest to kubesec for static analysis?

Accepted Answer

cat deploy.yaml | kubesec scan /dev/stdin. `kubesec scan /dev/stdin` reads the YAML manifest from standard input, which is provided by piping the output of `cat deploy.yaml`. This is a valid method for static analysis with kubesec, as it accepts input via stdin for flexibility in CI/CD pipelines. Option D is correct because `kubesec scan deploy.yaml` directly references a local file, which is the standard way to analyze a manifest file with kubesec. Options B and C are incorrect because `kubectl apply` or `kubectl get` output may include cluster-specific metadata or status fields that are not part of the original manifest, and kubesec is designed for static analysis of raw manifests, not live objects. Option E is invalid because `kubesec curl` is not a real command.

Answer

kubectl apply -f deploy.yaml | kubesec scan

Answer

kubectl get deployment myapp -o yaml | kubesec scan

Answer

kubesec curl https://example.com/deploy.yaml

Question 2

Which TWO of the following are best practices for Dockerfile security according to CKS guidelines?

Accepted Answer

RUN adduser -D myuser && USER myuser. It creates a dedicated non-root user (`adduser -D myuser`) and then switches to that user with `USER myuser`, ensuring the container runs without root privileges. This aligns with the CKS best practice of least privilege, reducing the risk of privilege escalation if the container is compromised. The `-D` flag in Alpine's `adduser` creates a user without a password, which is appropriate for containerized environments.

Answer

RUN useradd -m myuser && USER root

Answer

COPY --from=builder /app /app

Answer

FROM alpine:latest

Question 3

Which THREE of the following are valid admission controllers involved in the Kubernetes admission flow that can be used for supply chain security?

Accepted Answer

MutatingAdmissionWebhook. MutatingAdmissionWebhook is a valid admission controller that can intercept and modify API requests before they are persisted. In the context of supply chain security, it can be used to enforce policies such as injecting sidecar proxies, adding image pull secrets, or modifying pod specifications to ensure compliance with trusted registries. This helps prevent the deployment of untrusted or tampered images.

Answer

ResourceQuota

Answer

PersistentVolumeClaim

Question 4

Which THREE of the following are valid flags for the 'trivy image' command to output results in different formats?

Accepted Answer

--format table. The `trivy image` command supports multiple output formats via the `--format` flag. The valid formats include `table`, `sarif`, and `json`, which are explicitly documented in Trivy's CLI help. `table` produces a human-readable summary, `sarif` outputs results in the SARIF (Static Analysis Results Interchange Format) standard, and `json` provides structured data for programmatic consumption.

Answer

--format xml

Answer

--format yaml

Question 5

A development team uses a custom container image for their application, built from a base image that includes multiple CVEs. The security team requires that no container runs with known critical vulnerabilities. Which approach best ensures that only images with no critical vulnerabilities are deployed in production?

Accepted Answer

Integrate an image scanner (e.g., Trivy) into the CI/CD pipeline to block builds with critical vulnerabilities.. Integrating an image scanner like Trivy into the CI/CD pipeline ensures that any image with critical vulnerabilities is blocked before it is even built or pushed to a registry. This shift-left approach prevents vulnerable images from ever reaching the production environment, aligning with the security team's requirement to deploy only images with no critical vulnerabilities.

Answer

Configure a Kubernetes admission controller (e.g., Kyverno) to reject pods using images with critical vulnerabilities.

Answer

Scan the base image before building the application image.

Answer

Manually review vulnerability reports after the image is deployed.

Question 6

You are a security engineer at a fintech startup. The company runs a Kubernetes cluster in production with hundreds of microservices. Recently, a container image from a public registry was compromised, and the attacker injected a backdoor that exfiltrated customer data. The CISO mandates that all images must come from an internal registry that only stores approved, scanned, and signed images. Currently, developers build images locally and push them to Docker Hub, then reference those images in Kubernetes manifests. You have deployed Harbor as a private registry with vulnerability scanning and Cosign for signing. However, you notice that some pods are still running images directly from Docker Hub. You need to enforce that only images from your internal Harbor registry can be used in the cluster. You cannot change the Kubernetes manifests immediately because of a large backlog. You have access to the cluster's kubelet configuration and can modify cluster-level components. Which single action will most effectively block any pod that tries to use an image not hosted on your internal registry?

Accepted Answer

Configure the containerd configuration on each node to use Harbor as a mirror for all registries and set endpoint to Harbor only, disabling direct pull from public registries.. Configuring containerd to use Harbor as a mirror for all registries and setting the endpoint to Harbor only effectively blocks pulls from any external registry at the container runtime level. This approach works even if Kubernetes manifests reference Docker Hub images, as the kubelet will redirect all image pull requests to the internal Harbor registry, preventing direct pulls from public registries. It enforces the policy without requiring immediate changes to existing manifests, which aligns with the constraint of not modifying them due to a large backlog. Option D (admission webhook) would require either modification of existing manifests or the webhook to deny pods that do not use the internal registry, but since manifests cannot be changed immediately, this would not affect already running pods unless they are recreated, making it less effective than runtime configuration. Option B (NetworkPolicy) only blocks network traffic but does not prevent the kubelet from pulling images from Docker Hub if the registry is reachable via a different path, and cached images can still be used.

Answer

Enforce a PodSecurityStandard that restricts containers from running with root privileges.

Answer

Apply a Kubernetes NetworkPolicy that blocks egress traffic from nodes to Docker Hub.

Answer

Deploy an admission webhook (e.g., OPA/Gatekeeper) that denies pods whose image registry is not the internal Harbor.

Question 7

A DevOps team uses a CI/CD pipeline to build container images and push them to a private registry. To minimize the risk of supply chain attacks, which of the following is the most effective security control to implement?

Accepted Answer

Sign all container images using a private key and verify the signature before deployment.. Signing container images with a private key and verifying the signature before deployment ensures image integrity and authenticity, directly mitigating supply chain attacks where an attacker could tamper with images in transit or at rest. This control, often implemented using tools like Notary or Cosign (part of the Sigstore project), provides cryptographic proof that the image was produced by a trusted source and has not been altered. Without signature verification, even a vulnerability-scanned image could be replaced with a malicious one, bypassing other controls.

Answer

Scan all images for vulnerabilities using Trivy before pushing to the registry.

Answer

Restrict access to the registry using Kubernetes RBAC and service accounts.

Answer

Implement network policies to restrict traffic to the registry endpoint.

Question 8

You are tasked with ensuring that all container images in your cluster are scanned for vulnerabilities before being deployed. You have set up Trivy in your CI/CD pipeline and want to enforce that only images with no critical vulnerabilities are allowed. Which admission controller should you configure to reject pods using non-compliant images?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to evaluate container images against an external policy backend (e.g., Trivy) before they are admitted into the cluster. It intercepts pod creation requests, sends the image reference to an external webhook for validation, and rejects pods whose images contain critical vulnerabilities. This makes it the correct choice for enforcing image vulnerability policies at admission time.

Answer

ValidatingAdmissionWebhook

Answer

PodSecurityPolicy (PSP)

Answer

ResourceQuota

Question 9

Which of the following is a best practice for securing container images?

Accepted Answer

Use minimal base images like distroless or Alpine. Using minimal base images like distroless or Alpine significantly reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could contain vulnerabilities. Distroless images contain only the application and its runtime dependencies, while Alpine uses musl libc and BusyBox to keep the image size small and minimize the number of Common Vulnerabilities and Exposures (CVEs) that need to be patched.

Answer

Hardcode passwords in Dockerfile as environment variables for convenience

Answer

Use the latest tag for base images to get the newest features

Answer

Run containers as root to simplify permission management

Question 10

Which tool can be used to generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to catalog packages (e.g., APK, DEB, RPM, Python, Java) and outputs the SBOM in formats like SPDX or CycloneDX, which are industry standards for supply chain transparency. This makes it the correct choice for generating an SBOM from a container image in a CKS context.

Answer

trivy

Answer

kubesec

Answer

checkov

Question 11

A cluster has both ImagePolicyWebhook and a mutating webhook that adds a sidecar. The admin notices that even when ImagePolicyWebhook rejects an image, the mutating webhook has already added the sidecar. What admission ordering issue is occurring?

Accepted Answer

Validating webhooks should run before mutating webhooks. In Kubernetes, admission controllers are invoked in a fixed order: mutating admission controllers (including MutatingAdmissionWebhook) run before validating ones (including ImagePolicyWebhook and ValidatingAdmissionWebhook). Therefore, the mutating webhook that adds the sidecar runs before ImagePolicyWebhook validates the image. This means even if ImagePolicyWebhook rejects the image, the sidecar has already been added. The issue is that validating webhooks should run before mutating webhooks to prevent such problems, but the fixed order prevents this. Option B is wrong because using a validating webhook still runs after mutating webhooks. Option C is a workaround but not related to the ordering issue. Option D is incorrect because you cannot change the order of built-in admission controllers; the order is fixed.

Answer

Use a validating webhook instead of ImagePolicyWebhook

Answer

The mutating webhook should be configured to skip pods with certain images

Answer

The ImagePolicyWebhook should be placed before the mutating webhook in the webhook configuration

Question 12

Which of the following is a best practice for securing container images?

Accepted Answer

Use distroless base images to minimize the attack surface. Distroless base images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities that could be exploited. This dramatically reduces the attack surface and aligns with the principle of least functionality, making it a best practice for securing container images in Kubernetes environments.

Answer

Run containers as root to ensure all permissions are available

Answer

Use the 'latest' tag for base images to get the latest features

Answer

Embed secrets directly in the Dockerfile for easy access

Question 13

Which of the following is a static analysis tool for Kubernetes manifests that can be used to find misconfigurations?

Accepted Answer

Kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes manifests against a set of built-in security policies. It scans YAML or JSON resource definitions and assigns a risk score based on misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments. This makes it the correct choice for identifying misconfigurations in Kubernetes manifests without executing them.

Answer

Trivy

Answer

Syft

Answer

Cosign

Question 14

A DevOps engineer wants to enforce that all container images running in the cluster are signed using Cosign. Which Kubernetes admission controller is designed for this purpose?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to enforce that container images meet certain criteria, such as being signed with Cosign, by querying an external webhook service that validates image signatures before admitting a pod. It intercepts pod creation requests and checks the image references against a configured policy, making it the correct choice for this Cosign-based image signing enforcement scenario.

Answer

MutatingAdmissionWebhook

Answer

PodSecurityPolicy (deprecated)

Answer

ValidatingAdmissionWebhook

Question 15

An administrator runs 'kubectl describe pod secure-pod' and sees that the pod is in a Pending state with the event 'Error: ImagePullBackOff' and the message 'unauthorized: authentication required'. The image is stored in a private registry. What is the most likely cause?

Accepted Answer

Missing imagePullSecret in the pod spec or in the namespace's default service account. The error 'unauthorized: authentication required' indicates that the kubelet cannot authenticate to the private registry. Kubernetes requires an imagePullSecret, which contains registry credentials (typically a Docker config JSON), to be attached either directly to the pod spec or to the namespace's default service account. Without this secret, the kubelet cannot pull the image, resulting in the ImagePullBackOff state.

Answer

The registry requires TLS 1.3 but the kubelet uses TLS 1.2

Answer

The image tag is misspelled

Answer

The registry hostname is not resolvable