CKS Supply Chain Security Practice Test 3 — 15 Questions

Question 1

You have a Kyverno policy that validates images are from a specific registry. However, a pod using an image from that registry is still blocked. The pod YAML includes 'imagePullPolicy: Always'. What could be the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pod uses a different registry name than the one in the policy (e.g., a mirror). Kyverno validates the image registry against the exact string specified in the policy. If the pod references an image from a mirror (e.g., `myregistry.io/nginx` instead of `myregistry.io/nginx`), or if the registry name differs (e.g., `docker.io` vs `registry-1.docker.io`), the validation fails even though the actual image content may be identical. The `imagePullPolicy: Always` is irrelevant to the registry check; it only affects when the kubelet pulls the image.

Answer

The imagePullPolicy is set to Always, causing Kyverno to ignore the registry check

Answer

Kyverno cannot validate images with a tag

Answer

The policy is missing the 'validate' rule type

Question 2

Which THREE of the following are tools used for static analysis of Kubernetes manifests?

Accepted Answer

kubesec. kubesec (A) is a static analysis tool that scans Kubernetes manifests and returns a risk score based on security best practices such as runAsNonRoot, readOnlyRootFilesystem, and resource limits, making it correct for this scenario. checkov (B) is a static analysis tool that includes Kubernetes manifest scanning via its built-in policies, so it qualifies as a static analysis tool for Kubernetes YAML. kube-score (C) statically analyzes Kubernetes object definitions and reports on reliability, security, and best-practice issues, so it is also correct. trivy (D) is primarily a vulnerability and misconfiguration scanner for container images, filesystems, and IaC, but it is not a Kubernetes-manifest static analysis tool in the same sense as the three marked answers. syft (E) is an SBOM generation tool that inventories packages and dependencies from container images and filesystems, not a static analyzer of Kubernetes manifests.

Answer

trivy

Answer

syft

Question 3

Which THREE of the following are valid admission controllers involved in the Kubernetes admission flow that can be used for supply chain security?

Accepted Answer

MutatingAdmissionWebhook. MutatingAdmissionWebhook is a valid admission controller that can intercept and modify API requests before they are persisted. In the context of supply chain security, it can be used to enforce policies such as injecting sidecar proxies, adding image pull secrets, or modifying pod specifications to ensure compliance with trusted registries. This helps prevent the deployment of untrusted or tampered images.

Answer

ResourceQuota

Answer

PersistentVolumeClaim

Question 4

Which TWO of the following tools can generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

syft. Syft (A) is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. Cosign attest (B) can also generate an SBOM for a container image using the `--type sbom` flag and attach it as an in-toto attestation. Both tools are capable of producing SBOMs.

Answer

Clair

Answer

kubesec

Answer

Snyk

Question 5

Which TWO of the following are best practices for securing the container supply chain?

Accepted Answer

Scan images for vulnerabilities in a CI pipeline before deploying.. Scanning images for vulnerabilities in a CI pipeline before deployment is a best practice because it catches known CVEs early, preventing vulnerable images from reaching production. Tools like Trivy, Clair, or Grype integrate into CI/CD to enforce policy gates, ensuring only compliant images proceed.

Answer

Embed API keys directly in container images for authentication.

Answer

Allow all images from any registry without verification to speed up development.

Answer

Use mutable tags like 'latest' for easier updates.

Question 6

A DevOps team wants to ensure that only signed images from a trusted registry are deployed in the cluster. They plan to use a webhook to intercept pod creation. Which tool is best suited for this task?

Accepted Answer

Kyverno with a verifyImages rule. Kyverno is a Kubernetes-native policy engine that can enforce image signature verification via its `verifyImages` rule. It intercepts pod creation through a dynamic admission webhook, checking that container images are signed with a trusted key (e.g., using Sigstore/Cosign) before the pod is admitted. This directly meets the requirement to only allow signed images from a trusted registry.

Answer

kubectl with --validate flag

Answer

Helm with signed charts

Answer

etcd with encryption at rest

Answer

Prometheus with alerting rules

Question 7

A security audit reveals that a container image running in production contains a critical vulnerability (CVE-2024-1234). The image was built from a base image that had the vulnerability. What is the MOST effective long-term solution to prevent such issues?

Accepted Answer

Rebuild the image using a patched base image and integrate vulnerability scanning into the CI pipeline.. The most effective long-term solution because it addresses the root cause by rebuilding the image from a patched base image, eliminating the vulnerability at the source. Integrating vulnerability scanning into the CI pipeline ensures that future images are automatically checked for known CVEs before deployment, preventing vulnerable images from reaching production. This aligns with the principle of shifting security left in the software supply chain.

Answer

Use a runtime security tool like Falco to detect exploitation attempts.

Answer

Patch the vulnerability by installing a security update inside the running container.

Answer

Add an admission controller that rejects images with vulnerabilities.

Answer

Switch to a different container runtime that is immune to the vulnerability.

Question 8

An organization uses a private container registry and wants to ensure that only images built from a specific CI/CD pipeline are deployed. Which combination of measures provides the strongest guarantee?

Accepted Answer

Generate signed attestations with in-toto during the CI pipeline and verify them using an admission webhook like Kyverno.. It implements a complete chain of custody for container images. In-toto generates signed attestations that record every step of the CI/CD pipeline (e.g., source code checkout, build, test), and an admission webhook like Kyverno verifies these attestations before allowing a pod to run. This ensures that only images that passed the exact, attested pipeline are deployed, providing the strongest guarantee against unauthorized or tampered images.

Answer

Implement network policies to restrict egress from pods to the registry.

Answer

Grant registry write access only to the CI system's service account.

Answer

Use a static analysis tool to check the Dockerfile before building.

Answer

Use a unique registry path and restrict access via firewall rules.

Question 9

You are the lead security engineer for a large financial institution. The organization runs a Kubernetes cluster with 500+ microservices. The supply chain security team has implemented the following measures: (1) All images are built from a minimal base image (distroless) and scanned with Trivy before being pushed to a private registry. (2) Images are signed using cosign with a key stored in a hardware security module (HSM). (3) Kyverno policies enforce that only signed images from the private registry can run, and also enforce that containers run as non-root. (4) A binary authorization (binauthz) style admission controller verifies attestations. Recently, a critical vulnerability (CVE-2024-0001) was discovered in a popular open-source library used by several microservices. The library is included as a dependency in the base image. The vulnerability is remotely exploitable and has a CVSS score of 9.8. The security team needs to remediate this quickly. They have already patched the library and updated the base image. What is the BEST course of action to ensure all running pods use the new image?

Accepted Answer

Update the image tag in each Deployment's spec to point to the new patched image, then perform a rolling update. The admission controller will verify signatures and attestations for the new image.. Updating the image tag in each Deployment triggers a rolling update, which creates new pods with the patched image. The admission controller (Kyverno) will verify the cosign signature and binary authorization attestation for the new image, ensuring supply chain security is maintained. This approach is the standard Kubernetes method for deploying image updates while preserving security controls.

Answer

SSH into each node, pull the new image, and use kubectl exec to update the library inside running containers.

Answer

Temporarily disable the admission controller that verifies signatures and then update the image tags.

Answer

Delete all running pods and let the ReplicaSets recreate them from the existing image.

Question 10

A development team uses a custom container image for their application, built from a base image that includes multiple CVEs. The security team requires that no container runs with known critical vulnerabilities. Which approach best ensures that only images with no critical vulnerabilities are deployed in production?

Accepted Answer

Integrate an image scanner (e.g., Trivy) into the CI/CD pipeline to block builds with critical vulnerabilities.. Integrating an image scanner like Trivy into the CI/CD pipeline ensures that any image with critical vulnerabilities is blocked before it is even built or pushed to a registry. This shift-left approach prevents vulnerable images from ever reaching the production environment, aligning with the security team's requirement to deploy only images with no critical vulnerabilities.

Answer

Configure a Kubernetes admission controller (e.g., Kyverno) to reject pods using images with critical vulnerabilities.

Answer

Scan the base image before building the application image.

Answer

Manually review vulnerability reports after the image is deployed.

Question 11

An organization uses a GitOps workflow with Argo CD to deploy applications to Kubernetes. The security team wants to ensure that container images are immutable and signed. They currently use a private container registry (Harbor) with vulnerability scanning and Cosign for signing. Which combination of controls best enforces that only signed and scanned images are deployed?

Accepted Answer

Enable Harbor's content trust feature to reject unsigned images, and use a Kyverno admission rule to verify Cosign signatures at deploy time.. It enforces a two-layer defense: Harbor's content trust rejects unsigned images at the registry level, and a Kyverno admission rule verifies Cosign signatures at deploy time. This ensures that even if an unsigned image bypasses the registry, it will be blocked by Kubernetes admission control, providing defense in depth for supply chain security.

Answer

Configure Argo CD to verify Cosign signatures before syncing the application.

Answer

Use imagePullSecrets in Kubernetes to ensure only Harbor images are used.

Answer

Add a Cosign verification step in the CI pipeline before pushing images to Harbor, and rely on that guarantee.

Question 12

You are auditing a cluster's supply chain security. You find that many pods are running images from public registries without any pinning or verification. Which TWO actions would most effectively reduce the risk of pulling malicious images?

Accepted Answer

Configure all deployments to use image digests instead of tags.. Using image digests (e.g., `nginx@sha256:abc123...`) pins the image to an immutable content hash, ensuring that the exact same image is pulled every time, even if the tag is updated to a malicious version. This prevents tag-mutation attacks where an attacker replaces a benign image tag with a compromised one. Digests are verified by the container runtime (containerd) against the registry's manifest, providing cryptographic assurance of image integrity.

Answer

Implement RBAC to restrict which users can create pods.

Answer

Enforce PodSecurityStandard baseline or restricted to block privileged containers.

Answer

Apply a network policy that blocks egress traffic to public registries.

Question 13

You are a security engineer at a fintech startup. The company runs a Kubernetes cluster in production with hundreds of microservices. Recently, a container image from a public registry was compromised, and the attacker injected a backdoor that exfiltrated customer data. The CISO mandates that all images must come from an internal registry that only stores approved, scanned, and signed images. Currently, developers build images locally and push them to Docker Hub, then reference those images in Kubernetes manifests. You have deployed Harbor as a private registry with vulnerability scanning and Cosign for signing. However, you notice that some pods are still running images directly from Docker Hub. You need to enforce that only images from your internal Harbor registry can be used in the cluster. You cannot change the Kubernetes manifests immediately because of a large backlog. You have access to the cluster's kubelet configuration and can modify cluster-level components. Which single action will most effectively block any pod that tries to use an image not hosted on your internal registry?

Accepted Answer

Configure the containerd configuration on each node to use Harbor as a mirror for all registries and set endpoint to Harbor only, disabling direct pull from public registries.. Configuring containerd to use Harbor as a mirror for all registries and setting the endpoint to Harbor only effectively blocks pulls from any external registry at the container runtime level. This approach works even if Kubernetes manifests reference Docker Hub images, as the kubelet will redirect all image pull requests to the internal Harbor registry, preventing direct pulls from public registries. It enforces the policy without requiring immediate changes to existing manifests, which aligns with the constraint of not modifying them due to a large backlog. Option D (admission webhook) would require either modification of existing manifests or the webhook to deny pods that do not use the internal registry, but since manifests cannot be changed immediately, this would not affect already running pods unless they are recreated, making it less effective than runtime configuration. Option B (NetworkPolicy) only blocks network traffic but does not prevent the kubelet from pulling images from Docker Hub if the registry is reachable via a different path, and cached images can still be used.

Answer

Enforce a PodSecurityStandard that restricts containers from running with root privileges.

Answer

Apply a Kubernetes NetworkPolicy that blocks egress traffic from nodes to Docker Hub.

Answer

Deploy an admission webhook (e.g., OPA/Gatekeeper) that denies pods whose image registry is not the internal Harbor.

Question 14

A DevOps team uses a CI/CD pipeline to build container images and push them to a private registry. To minimize the risk of supply chain attacks, which of the following is the most effective security control to implement?

Accepted Answer

Sign all container images using a private key and verify the signature before deployment.. Signing container images with a private key and verifying the signature before deployment ensures image integrity and authenticity, directly mitigating supply chain attacks where an attacker could tamper with images in transit or at rest. This control, often implemented using tools like Notary or Cosign (part of the Sigstore project), provides cryptographic proof that the image was produced by a trusted source and has not been altered. Without signature verification, even a vulnerability-scanned image could be replaced with a malicious one, bypassing other controls.

Answer

Scan all images for vulnerabilities using Trivy before pushing to the registry.

Answer

Restrict access to the registry using Kubernetes RBAC and service accounts.

Answer

Implement network policies to restrict traffic to the registry endpoint.

Question 15

Refer to the exhibit. A cluster has the ClusterImagePolicy shown. A developer creates a pod with an image from registry.example.com/myapp:v1, which was built and signed by a GitHub Actions workflow that is NOT defined in the policy (different workflow). Which behavior will occur when the pod is created?

Accepted Answer

The pod is denied because the image's signer identity does not match the policy.. The ClusterImagePolicy enforces that images must be signed by a specific identity (the GitHub Actions workflow defined in the policy). The image from registry.example.com/myapp:v1 was signed by a different workflow, so the signer identity does not match the policy's required identity. Sigstore keyless signing verifies the OIDC identity embedded in the signature, and if the identity does not match the policy's `issuer` and `subject` patterns, the admission controller denies the pod.

Answer

The pod is admitted because keyless signing does not enforce identity matching.

Answer

The pod is admitted because the policy only applies to images with a tag 'v*'.

Answer

The pod is admitted because the image is from the allowed registry.