CKS Supply Chain Security Practice Test 2 — 15 Questions

Question 1

You are tasked with ensuring that all container images in your cluster are scanned for vulnerabilities before being deployed. You have set up Trivy in your CI/CD pipeline and want to enforce that only images with no critical vulnerabilities are allowed. Which admission controller should you configure to reject pods using non-compliant images?

Accepted Answer

ImagePolicyWebhook. Option C is correct. ImagePolicyWebhook is a Kubernetes admission controller that can be configured to call an external webhook to validate container images. It can reject pods based on policies such as vulnerability scan results. Other options are not designed for this purpose.

Answer

ValidatingAdmissionWebhook

Answer

PodSecurityPolicy (PSP)

Answer

ResourceQuota

Question 2

Which of the following is a best practice for securing container images?

Accepted Answer

Use minimal base images like distroless or Alpine. Option D is correct. Using distroless or Alpine base images reduces the attack surface by minimizing packages and vulnerabilities. Options A, B, and C are insecure practices.

Answer

Hardcode passwords in Dockerfile as environment variables for convenience

Answer

Use the latest tag for base images to get the newest features

Answer

Run containers as root to simplify permission management

Question 3

A security engineer wants to ensure that only images signed with a specific key are allowed to run in the cluster. Which tool can be used to sign container images?

Accepted Answer

cosign. Option A is correct. Cosign is a tool for signing and verifying container images. Option B (Trivy) is for scanning vulnerabilities. Option C (Syft) generates SBOMs. Option D (kubesec) analyzes Kubernetes manifests.

Answer

kubesec

Answer

syft

Answer

trivy

Question 4

A developer wants to create a Deployment that runs as a non-root user. Which YAML snippet correctly sets the security context to run the container with UID 1000?

Accepted Answer

spec.containers[].securityContext.runAsUser: 1000. Option A is correct. The securityContext field at the container level with runAsUser: 1000 ensures the container runs as a non-root user. Option B uses runAsGroup which is for group ID, not user ID. Option C places securityContext at the pod level, which also works but is not the only correct approach. Option D uses the incorrect field name 'runAsNonRoot' which is a boolean and does not set the UID.

Answer

spec.containers[].securityContext.runAsUser: 0

Answer

spec.containers[].securityContext.runAsNonRoot: true

Answer

spec.containers[].securityContext.runAsGroup: 1000

Question 5

You are configuring an ImagePolicyWebhook admission controller to allow only images from a trusted registry 'trusted-registry.io'. Which flag must be set in the kube-apiserver configuration to enable the webhook?

Accepted Answer

--admission-control-config-file. Option C is correct. The --admission-control-config-file flag points to a configuration file that specifies the image policy webhook and other admission plugins. Option A is not a valid flag. Option B is for enabling the webhook but does not specify the configuration file. Option D is for the old PodSecurityPolicy.

Answer

--pod-security-policy

Answer

--image-policy-webhook-config

Answer

--enable-admission-plugins=ImagePolicyWebhook

Question 6

A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?

Accepted Answer

OPA/Gatekeeper. Option C is correct. OPA/Gatekeeper can enforce custom policies using constraints, including checking image tags. Option A (PodSecurityPolicy) is deprecated. Option B (NetworkPolicy) controls network traffic. Option D (ResourceQuota) limits resources.

Answer

ResourceQuota

Answer

NetworkPolicy

Answer

PodSecurityPolicy (PSP)

Question 7

Developer A runs 'cosign verify --key cosign.pub myregistry/myimage:tag' and receives an error: 'No signatures found'. Developer B previously ran 'cosign sign --key cosign.key myregistry/myimage:tag'. What is the most likely cause of the verification failure?

Accepted Answer

The signing command failed to push the signature to the registry. Option A is correct. The error 'No signatures found' indicates that the image does not have a signature attached to it. This could happen if the signing command did not push the signature to the registry. Option B is irrelevant because the image tag exists. Option C is incorrect because the signing command uses the private key. Option D is incorrect; the verification command uses the public key, but the error is about missing signatures, not key mismatch.

Answer

The image tag does not exist in the registry

Answer

Developer B used a different private key to sign than the public key used for verification

Answer

Developer A used the public key instead of the private key

Question 8

Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?

Accepted Answer

syft. Option D is correct. Syft is a CLI tool that generates SBOMs for container images. Trivy is for vulnerability scanning. Cosign is for signing. Kubesec is for manifest scanning.

Answer

kubesec

Answer

trivy

Answer

cosign

Question 9

A DevOps engineer is setting up a CI/CD pipeline to scan container images for vulnerabilities. They want to fail the pipeline if any critical vulnerabilities are found. Which command should they use to scan the image and produce a JSON output that can be parsed?

Accepted Answer

trivy image --severity CRITICAL --output json myimage:tag. Option B is correct. 'trivy image --severity CRITICAL --output json myimage:tag' will scan the image and return JSON output only for critical severity vulnerabilities. Option A uses severity HIGH which might not include critical. Option C outputs a table format. Option D scans the filesystem, not the image.

Answer

trivy fs --severity CRITICAL --output json .

Answer

trivy image --format table myimage:tag

Answer

trivy image --severity HIGH myimage:tag

Question 10

You have configured Kyverno to enforce that all Pods must have an image from a trusted registry. However, a newly created Pod is not being rejected even though it uses an untrusted image. What is the most likely reason?

Accepted Answer

The Kyverno webhook is not invoked because the failure policy is set to Ignore or the resource is not matched by the policy's rules. Option D is correct. Kyverno policies are implemented as a MutatingAdmissionWebhook or ValidatingAdmissionWebhook, and they must be properly configured with the correct failurePolicy and match conditions. If the webhook is not properly configured, the request may bypass the policy. Option A is wrong because Kyverno uses webhooks, not the ImagePolicyWebhook. Option B is not specific to this issue. Option C is wrong because Kyverno can validate resources without an external registry.

Answer

Kyverno is not an admission controller; it only mutates resources

Answer

The Kyverno policy requires an external registry to compare images, which is unavailable

Answer

The Pod was created by a Deployment controller, which bypasses admission control

Question 11

Which of the following is a static analysis tool for Kubernetes manifests that can identify security misconfigurations?

Accepted Answer

kubesec. Option A is correct. kubesec is a tool that analyzes Kubernetes resource manifests for security issues. Clair is for image scanning. Notary is for image signing. OPA/Gatekeeper is for admission control, not static analysis.

Answer

Clair

Answer

OPA/Gatekeeper

Answer

Notary

Question 12

You need to ensure that all containers in your cluster run with a read-only root filesystem. Which field should be set in the container's security context?

Accepted Answer

readOnlyRootFilesystem: true. Option B is correct. 'readOnlyRootFilesystem: true' in the security context makes the container's root filesystem read-only. Option A is for running as non-root. Option C is for dropping capabilities. Option D is for privilege escalation.

Answer

allowPrivilegeEscalation: false

Answer

capabilities.drop: ['ALL']

Answer

runAsNonRoot: true

Question 13

Which two of the following are best practices for container image security? (Select TWO.)

Accepted Answer

Run containers as a non-root user. Options A and C are correct. Using pinned SHA digests ensures immutability and prevents unexpected updates. Running as non-root reduces security risks. Option B is wrong because the 'latest' tag introduces uncertainty. Option D is wrong; multiple layers increase build time and can hide vulnerabilities. Option E is wrong because base images should be kept up-to-date to fix CVEs.

Answer

Maximize the number of layers to improve caching

Answer

Use the 'latest' tag for flexibility

Answer

Use old base images to avoid breaking changes

Question 14

Which three of the following are valid ways to enforce supply chain security in a Kubernetes cluster? (Select THREE.)

Accepted Answer

Use Cosign to sign images and configure verification in the cluster. Options A, B, and D are correct. Using ImagePolicyWebhook enforces image policies. OPA/Gatekeeper can enforce policies like allowed registries. Cosign is used for image signing and verification. Option C is wrong because NetworkPolicy does not enforce image policies. Option E is wrong because ResourceQuota does not enforce image policies.

Answer

Use ResourceQuota to limit the number of images that can be pulled

Answer

Use NetworkPolicy to block egress traffic to unknown registries

Question 15

Which two of the following are best practices for securing a CI/CD pipeline that builds and deploys container images? (Select TWO.)

Accepted Answer

Scan container images for vulnerabilities in the pipeline. Options A and C are correct. Scanning images for vulnerabilities in the pipeline ensures that insecure images are not deployed. Signing images ensures integrity and provenance. Option B is wrong because storing secrets in environment variables in the pipeline is insecure; use secret management. Option D is wrong because running builds as root increases risk. Option E is wrong because granting all permissions violates the principle of least privilege.

Answer

Store secrets as environment variables in the pipeline configuration

Answer

Run the build process as root to avoid permission issues

Answer

Grant all permissions to the pipeline service account to avoid failures