CKS Supply Chain Security Practice Test 2 — 15 Questions

Question 1

A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is the correct tool because it allows you to define and enforce custom admission control policies via ConstraintTemplates and Constraints. You can create a policy that rejects any Pod using an image tagged with 'latest' by inspecting the `spec.containers[].image` field at admission time, which is not possible with native Kubernetes resources.

Answer

ResourceQuota

Answer

NetworkPolicy

Answer

PodSecurityPolicy (PSP)

Question 2

Developer A runs 'cosign verify --key cosign.pub myregistry/myimage:tag' and receives an error: 'No signatures found'. Developer B previously ran 'cosign sign --key cosign.key myregistry/myimage:tag'. What is the most likely cause of the verification failure?

Accepted Answer

The signing command failed to push the signature to the registry. The error 'No signatures found' indicates that the verification process could not locate any signature associated with the image in the registry. Since Developer B attempted to sign the image with 'cosign sign', the most likely cause is that the signing command failed to push the signature artifact (typically stored as a separate tag like 'myimage:sha256-<digest>.sig' in the same registry) to the registry. Without the signature being successfully uploaded, the 'cosign verify' command finds nothing to validate against the provided public key.

Answer

The image tag does not exist in the registry

Answer

Developer B used a different private key to sign than the public key used for verification

Answer

Developer A used the public key instead of the private key

Question 3

Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?

Accepted Answer

syft. Syft is a CLI tool purpose-built for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to extract package metadata (e.g., dpkg, RPM, APK, Python, Node.js) and outputs the SBOM in formats like CycloneDX or SPDX, which are the industry standards for supply chain transparency.

Answer

kubesec

Answer

trivy

Answer

cosign

Question 4

A DevOps engineer is setting up a CI/CD pipeline to scan container images for vulnerabilities. They want to fail the pipeline if any critical vulnerabilities are found. Which command should they use to scan the image and produce a JSON output that can be parsed?

Accepted Answer

trivy image --severity CRITICAL --output json myimage:tag. `trivy image` scans a container image (not filesystem), and the `--severity CRITICAL` flag filters results to critical vulnerabilities only, while `--output json` produces machine-parseable JSON output. This allows the CI/CD pipeline to parse the JSON and fail the build if any critical vulnerabilities are present, meeting the requirement exactly.

Answer

trivy fs --severity CRITICAL --output json .

Answer

trivy image --format table myimage:tag

Answer

trivy image --severity HIGH myimage:tag

Question 5

You have configured Kyverno to enforce that all Pods must have an image from a trusted registry. However, a newly created Pod is not being rejected even though it uses an untrusted image. What is the most likely reason?

Accepted Answer

The Kyverno webhook is not invoked because the failure policy is set to Ignore or the resource is not matched by the policy's rules. Kyverno operates as a dynamic admission controller via a MutatingAdmissionWebhook or ValidatingAdmissionWebhook. If the webhook's failure policy is set to `Ignore`, the webhook will not block the Pod creation when it fails to invoke, and the Pod will be admitted. Additionally, if the policy's rules do not match the Pod (e.g., due to incorrect resource selection or namespace exclusion), the webhook will not be triggered, allowing untrusted images through.

Answer

Kyverno is not an admission controller; it only mutates resources

Answer

The Kyverno policy requires an external registry to compare images, which is unavailable

Answer

The Pod was created by a Deployment controller, which bypasses admission control

Question 6

Which of the following is a static analysis tool for Kubernetes manifests that can identify security misconfigurations?

Accepted Answer

kubesec. kubesec is a static analysis tool that scans Kubernetes manifests (YAML/JSON) and assigns a security score based on misconfigurations such as running containers as root, missing resource limits, or allowing privilege escalation. It operates offline without requiring a running cluster, making it a pure static analysis tool for identifying security issues in manifests before deployment.

Answer

Clair

Answer

OPA/Gatekeeper

Answer

Notary

Question 7

You need to ensure that all containers in your cluster run with a read-only root filesystem. Which field should be set in the container's security context?

Accepted Answer

readOnlyRootFilesystem: true. Setting `readOnlyRootFilesystem: true` in the container's security context mounts the container's root filesystem as read-only, preventing any writes to the root filesystem. This directly enforces the requirement that all containers run with a read-only root filesystem, which is a key supply chain security control to limit the impact of a compromised container.

Answer

allowPrivilegeEscalation: false

Answer

capabilities.drop: ['ALL']

Answer

runAsNonRoot: true

Question 8

Which two of the following are best practices for container image security? (Select TWO.)

Accepted Answer

Run containers as a non-root user. Running containers as a non-root user follows the principle of least privilege, reducing the risk of privilege escalation if the container is compromised. By default, Docker containers run as root, but using the USER directive in the Dockerfile or specifying a non-root user at runtime (e.g., --user 1000) limits the attacker's ability to modify system files or escape the container.

Answer

Maximize the number of layers to improve caching

Answer

Use the 'latest' tag for flexibility

Answer

Use old base images to avoid breaking changes

Question 9

Which three of the following are valid ways to enforce supply chain security in a Kubernetes cluster? (Select THREE.)

Accepted Answer

Use Cosign to sign images and configure verification in the cluster. A is correct because Cosign is a tool for signing container images using cryptographic keys, and by integrating it with Kubernetes admission controllers (e.g., via the Cosign webhook or Kyverno), the cluster can verify image signatures before allowing a pod to run. This ensures that only images signed by trusted parties are deployed, directly enforcing supply chain integrity.

Answer

Use ResourceQuota to limit the number of images that can be pulled

Answer

Use NetworkPolicy to block egress traffic to unknown registries

Question 10

Which two of the following are best practices for securing a CI/CD pipeline that builds and deploys container images? (Select TWO.)

Accepted Answer

Scan container images for vulnerabilities in the pipeline. Scanning container images for vulnerabilities in the pipeline is a fundamental supply chain security practice. It ensures that known Common Vulnerabilities and Exposures (CVEs) in base images or application dependencies are detected before the image is deployed, reducing the attack surface. Tools like Trivy, Clair, or Anchore Grype can be integrated into the CI/CD pipeline to fail the build if critical vulnerabilities are found, enforcing a security gate.

Answer

Store secrets as environment variables in the pipeline configuration

Answer

Run the build process as root to avoid permission issues

Answer

Grant all permissions to the pipeline service account to avoid failures

Question 11

Which of the following is a best practice for securing container images in a CI/CD pipeline?

Accepted Answer

Using a minimal base image such as Alpine. Using a minimal base image like Alpine reduces the attack surface by minimizing the number of installed packages and potential vulnerabilities.

Answer

Using the 'latest' tag for all base images to ensure the newest features

Answer

Running the container as root to avoid permission issues

Answer

Installing all available packages to ensure the application has all dependencies

Question 12

An administrator runs 'trivy image myapp:1.0' and receives an output with several CRITICAL vulnerabilities. What is the best next step to ensure the image is secure before deployment?

Accepted Answer

Rebuild the image using updated base images and fix the identified vulnerabilities. The best practice for addressing container image vulnerabilities is to rebuild the image using updated base images and apply patches for the identified CVEs. Trivy reports vulnerabilities in the image layers, and simply deleting or ignoring them does not resolve the security issues; rebuilding with patched dependencies ensures the image is secure before deployment.

Answer

Delete the image entirely and do not deploy

Answer

Deploy the image anyway because vulnerabilities are common

Answer

Ignore the output and re-run the scan

Question 13

A cluster uses ImagePolicyWebhook admission controller. After configuring it, deployments referencing images from an unauthorized registry are blocked. However, some deployments are still being admitted. What is a possible cause?

Accepted Answer

The ImagePolicyWebhook is placed after mutating admission webhooks in the admission chain. The ImagePolicyWebhook admission controller must be placed before mutating admission webhooks in the admission chain. If it is placed after mutating webhooks, a mutating webhook could modify the image reference (e.g., rewriting the registry URL) after the ImagePolicyWebhook has already validated it, effectively bypassing the policy. The order of admission controllers in the kube-apiserver's `--enable-admission-plugins` flag matters, and the ImagePolicyWebhook should be early in the chain to enforce policy before any mutations occur.

Answer

The ImagePolicyWebhook is configured with a low timeout

Answer

The registry is allowlisted in the webhook configuration

Answer

The admission controller is disabled

Question 14

Which command is used to sign a container image with Cosign and store the signature in an OCI registry?

Accepted Answer

cosign sign --key cosign.key myimage:latest. `cosign sign --key cosign.key myimage:latest` is the standard Cosign command to sign a container image using a private key and store the resulting signature in the OCI registry as an attached artifact (e.g., a `.sig` layer). This command generates a signature that is automatically pushed to the same registry alongside the image, enabling verification without external storage.

Answer

cosign docker-sign myimage:latest

Answer

cosign verify --key cosign.pub myimage:latest

Answer

cosign attach signature --key cosign.key myimage:latest

Question 15

A Kubernetes cluster has Kyverno installed. A policy requires that all images come from a trusted registry 'trusted.example.com'. A Deployment uses the image 'nginx:latest'. When the Deployment is created, it is blocked. What Kyverno policy action is being used?

Accepted Answer

validate with failureAction: enforce. Kyverno's `validate` policy with `failureAction: enforce` is the mechanism that blocks resource creation when validation rules are violated. In this scenario, the policy checks that the image comes from `trusted.example.com`, and since `nginx:latest` does not match, the policy actively denies the Deployment, which is the behavior of `enforce` mode.

Answer

audit

Answer

mutate

Answer

generate