CKS Supply Chain Security Practice Test 2 — 15 Questions

Question 1

Which admission controller is responsible for invoking external webhooks to validate or mutate resources?

Accepted Answer

ValidatingAdmissionWebhook. The ValidatingAdmissionWebhook admission controller is responsible for invoking external webhooks that validate resources. While there is a separate controller, MutatingAdmissionWebhook, for mutation, the question's inclusion of 'or mutate' can be misleading. The correct answer is ValidatingAdmissionWebhook because it handles validation, and the phrase 'validate or mutate' is meant to test the candidate's ability to distinguish between the two controllers.

Answer

ImagePolicyWebhook

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Question 2

An administrator wants to ensure that all containers in a deployment run as a non-root user. Which YAML snippet correctly sets the security context to run as user ID 1000?

Accepted Answer

securityContext:
  runAsUser: 1000. It correctly sets the security context at the pod or container level with the `runAsUser` field, which instructs the container runtime (e.g., containerd) to set the user ID to 1000 for the container's main process. This ensures the container does not run as root (UID 0), aligning with the principle of least privilege.

Answer

runAsUser: 1000

Answer

securityContext: { runAsNonRoot: true }

Answer

user: 1000

Question 3

Which admission controller is responsible for validating and modifying images based on an external webhook in Kubernetes?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to validate and modify container images by querying an external webhook before admitting a pod. It allows an external service to enforce image policies, such as checking image signatures or blocking untrusted registries, making it the correct answer for this scenario.

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Answer

ValidatingAdmissionWebhook

Question 4

An OPA/Gatekeeper constraint is configured to require all container images to be from a specific registry. A user creates a Pod with image 'gcr.io/myimage:v1'. Which admission controller will first reject this Pod?

Accepted Answer

ValidatingAdmissionWebhook. OPA/Gatekeeper enforces policies via ValidatingAdmissionWebhooks, which intercept admission requests and validate them against constraints. When a Pod with image 'gcr.io/myimage:v1' is created, the ValidatingAdmissionWebhook (C) processes the request, checks the constraint requiring images from a specific registry, and rejects the Pod if the image does not match. This is the correct admission controller because Gatekeeper uses ValidatingAdmissionWebhooks to enforce its constraint templates.

Answer

PodSecurity

Answer

ImagePolicyWebhook

Answer

MutatingAdmissionWebhook

Question 5

Which command would scan a Kubernetes Pod manifest for security issues?

Accepted Answer

checkov -f pod.yaml. Both A and D are correct because `checkov -f pod.yaml` and `kubesec scan pod.yaml` are static analysis tools that scan Kubernetes YAML manifests for security misconfigurations such as privileged containers, hostNetwork access, and violations of Pod Security Standards. Checkov is a general IaC scanner supporting Kubernetes, while kubesec is specialized for Kubernetes resources. Options B and C are incorrect: `trivy image` scans container images for vulnerabilities, not manifest files, and `cosign verify` verifies container image signatures. Thus, A and D are valid commands for scanning a Pod manifest.

Answer

trivy image pod.yaml

Answer

cosign verify pod.yaml

Question 6

An administrator wants to enforce that all pods run with read-only root filesystem. Which admission controller can achieve this without writing custom code?

Accepted Answer

PodSecurity. The PodSecurity admission controller enforces the Pod Security Standards (PSS), which include a policy to restrict pods to a read-only root filesystem. Specifically, the 'Restricted' profile sets `readOnlyRootFilesystem: true` as a required field, preventing pods from writing to their root filesystem without custom code.

Answer

ServiceAccount

Answer

MutatingAdmissionWebhook

Answer

ImagePolicyWebhook

Question 7

Which TWO are tools for static analysis of Kubernetes manifests? (Select 2)

Accepted Answer

Kubesec. Kubesec (C) is a static analysis tool that scans Kubernetes manifests (YAML/JSON) and assigns a risk score based on security best practices such as runAsNonRoot, readOnlyRootFilesystem, and resource limits, so it directly fits the scenario. Checkov (E) is a static analysis tool that includes Kubernetes manifest scanning among its IaC policies, evaluating YAML files against built-in security and compliance checks before deployment. Cosign (A) is used for signing and verifying container images and artifacts, not for statically analyzing manifests. Trivy (B) is primarily a vulnerability and misconfiguration scanner for images, filesystems, and repositories, and Clair (D) is a container image vulnerability scanner; neither is a manifest static analysis tool in the sense required here.

Answer

Cosign

Answer

Trivy

Answer

Clair

Question 8

An administrator runs `kubectl run nginx --image=nginx:latest` and the pod remains in ImagePullBackoff. The cluster uses containerd as the container runtime. What is the most likely cause?

Accepted Answer

The container runtime is not configured correctly. ImagePullBackoff indicates that the kubelet failed to pull the container image. For a public image like nginx:latest, no Docker Hub authentication is required for a standard pull. The failure is best attributed to a misconfiguration of the containerd runtime, such as an invalid registry mirror, missing/incorrect containerd plugin configuration, or network restrictions that prevent the node from reaching Docker Hub. Option B correctly identifies that the container runtime is not configured correctly.

Answer

The image tag 'latest' is not recommended

Answer

The image name is misspelled

Answer

The cluster does not have authentication to pull from Docker Hub

Question 9

You need to generate an SBOM for a container image. Which command should you use?

Accepted Answer

syft . Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It outputs the SBOM in formats like CycloneDX or SPDX, which are industry standards for supply chain security. The command `syft ` directly produces an SBOM for the given container image, making it the correct choice for this task.

Answer

cosign sbom <image>

Answer

trivy sbom <image>

Answer

kubectl sbom <pod>

Question 10

Which THREE of the following are best practices for Dockerfile security? (Select THREE)

Accepted Answer

Pin base image versions using SHA256 digests. Option B is correct because pinning base images by SHA256 digest (e.g., FROM alpine@sha256:...) guarantees immutability and prevents tag-mutability or supply-chain attacks where a tag like :latest is silently repointed to a malicious or vulnerable image. Option C is correct because specifying a non-root user with the USER directive enforces least privilege, so if the container is compromised the attacker does not get root inside the container and cannot easily escalate to the host. Option D is correct because COPY only copies local files from the build context, whereas ADD can fetch remote URLs and auto-extract tar archives, which expands the attack surface and can introduce untrusted content. Option E is correct because multi-stage builds let you compile in a builder stage and copy only the needed artifacts into a minimal final image, reducing size and eliminating build tools, package managers, and source code that would otherwise be exploitable. Option A is not a best practice because installing curl, vim, and other debugging tools in the final image increases the attack surface and image size; such tools should be confined to build or debug stages, not shipped to production.

Answer

Install debugging tools like curl and vim in the final image

Question 11

Which tool can generate an SBOM (Software Bill of Materials) from a container image?

Accepted Answer

syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to extract package metadata from package managers (e.g., dpkg, RPM, APK) and produces SBOMs in formats like SPDX and CycloneDX, directly addressing the requirement for supply chain transparency.

Answer

kubesec

Answer

trivy

Answer

checkov

Question 12

Which kubectl command signs a container image using Cosign?

Accepted Answer

cosign sign myimage:latest. Cosign is a standalone tool for signing and verifying container images, not a kubectl subcommand. The correct command is `cosign sign myimage:latest`, which signs the image and stores the signature in an OCI-compliant registry alongside the image. This is part of the supply chain security workflow for ensuring image integrity and provenance.

Answer

crictl sign myimage:latest

Answer

kubectl sign image myimage:latest

Answer

kubectl cosign sign myimage:latest

Question 13

Which THREE are valid admission controllers in Kubernetes? (Select three.)

Accepted Answer

ImagePolicyWebhook. ImagePolicyWebhook (C) is a valid admission controller that sends admission requests to an external HTTP service to decide whether an image is allowed, and it is enabled via the --enable-admission-plugins flag. MutatingAdmissionWebhook (D) is a valid admission controller that calls mutating webhooks to modify objects before persistence, and it is part of the standard admission chain. PodSecurity (E) is a valid admission controller that enforces the Pod Security Standards (privileged, baseline, restricted) at the namespace level via labels. ServiceAccount (A) is not an admission controller; it is an API resource/controller that manages ServiceAccount objects and token mounting, not an admission plugin. NetworkPolicy (B) is not an admission controller; it is a networking API resource implemented by the CNI plugin to control pod traffic.

Answer

ServiceAccount

Answer

NetworkPolicy

Question 14

You are asked to generate an SBOM for a container image and attach it as an attestation using cosign. Which two commands would you run in sequence?

Accepted Answer

syft myimage:latest -o spdx > sbom.spdx && cosign attest --type spdx --predicate sbom.spdx myimage:latest. It first uses Syft to generate an SPDX-format SBOM from the container image, then uses cosign attest to attach that SBOM as an in-toto attestation to the image. This sequence satisfies the requirement to generate an SBOM and attach it as an attestation using cosign.

Answer

trivy image --format spdx myimage:latest > sbom.spdx && cosign verify --key cosign.pub myimage:latest

Answer

cosign sign --key cosign.key myimage:latest && syft myimage:latest -o spdx

Answer

crane ls myimage:latest && cosign attest --type spdx --predicate sbom.spdx myimage:latest

Question 15

A CI pipeline uses 'checkov' to scan Kubernetes manifests. Which of the following is a common checkov check related to supply chain security?

Accepted Answer

CKV_K8S_3: Ensure that the image is signed. Checkov rule CKV_K8S_3 specifically checks that container images are signed, which directly addresses supply chain security by verifying image integrity and origin. In a CI pipeline, this helps prevent the deployment of tampered or unauthorized images, a key concern for supply chain attacks.

Answer

CKV_K8S_2: Ensure that the container has a read-only root filesystem

Answer

CKV_K8S_4: Ensure that the container uses a non-root user

Answer

CKV_K8S_1: Pod Security Policy