CKS Supply Chain Security Practice Test 3 — 15 Questions

Question 1

A security policy requires that all container images use SHA-based digests instead of tags. Which approach ensures this in a Deployment YAML?

Accepted Answer

Use the image field with a digest, e.g., 'image: nginx@sha256:abc123'. Kubernetes supports using a SHA-based digest in the `image` field, which ensures the exact image content is pulled regardless of tag changes. By specifying the image as `nginx@sha256:abc123`, the container runtime fetches the image by its immutable digest, guaranteeing supply chain integrity and compliance with the security policy.

Answer

Use the 'image' field with a tag and also set 'digest' field

Answer

Set imagePullPolicy: Always and use tags

Answer

Set imagePullPolicy: IfNotPresent and use tags

Question 2

A CI/CD pipeline uses cosign attest to add an SBOM attestation to an image. Later, during deployment, which command verifies the attestation?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. `cosign verify-attestation` is the specific command designed to verify an in-toto attestation (such as an SBOM) attached to a container image. It checks the signature on the attestation using the provided public key (`--key cosign.pub`) and validates that the attestation's payload matches the image digest, ensuring the SBOM was generated and signed by the trusted party.

Answer

cosign verify --key cosign.pub myimage:latest

Answer

cosign attest --key cosign.key --predicate sbom.json myimage:latest

Answer

cosign download attestation myimage:latest

Question 3

Which of the following is a recommended Dockerfile best practice to improve container security?

Accepted Answer

Use a non-root user with USER directive. Running containers as root is a major security risk; if an attacker compromises the container, they gain root access to the container and potentially the host via kernel exploits. The USER directive in a Dockerfile switches the container's runtime user to a non-root user (e.g., USER 1000), reducing the blast radius by limiting privileges within the container. This aligns with the principle of least privilege and is a recommended best practice in the CKS exam for supply chain security.

Answer

Hardcode secrets in environment variables in the Dockerfile

Answer

Run the container as root to simplify permission management

Answer

Copy the entire host filesystem into the image

Question 4

An OPA/Gatekeeper constraint requires that all images' registries match a pattern. A Deployment uses 'myregistry.io/app:v1'. The admission controller rejects it. The admin runs 'kubectl get constraints' and sees the constraint is active. What is the next debugging step?

Accepted Answer

Describe the constraint and constraint template to see the denial reason. When a Gatekeeper constraint is active but a resource is rejected, the next debugging step is to describe the constraint and its associated constraint template. The constraint template contains the Rego policy logic, and describing both objects reveals the specific denial reason, such as a pattern mismatch or a violation of the allowed registries list. This provides the exact error message from the OPA engine, enabling targeted troubleshooting without disabling or bypassing the admission controller.

Answer

Disable the Gatekeeper webhook

Answer

Check the audit logs of Gatekeeper

Answer

Reapply the Deployment YAML

Question 5

Which tool can be used to perform static analysis of Kubernetes manifests for security issues?

Accepted Answer

kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes resource manifests against a set of built-in security best practices. It scans YAML or JSON manifests for common misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments, and returns a risk score. This makes it the correct choice for static analysis of Kubernetes manifests for security issues.

Answer

syft

Answer

cosign

Answer

trivy

Question 6

Which TWO of the following are valid methods to ensure only signed images are deployed in a Kubernetes cluster?

Accepted Answer

Configure ImagePolicyWebhook to require signatures. The ImagePolicyWebhook admission controller can be configured to reject pods that reference images without valid signatures. It works by sending an admission review request to an external webhook service (e.g., using Cosign or Notary) that validates the image signature before allowing the pod to be created. This enforces signature verification at admission time, preventing unsigned images from running in the cluster.

Answer

Set imagePullPolicy: Always

Answer

Run 'cosign verify' manually before every deployment

Answer

Use NodeRestriction admission controller

Question 7

Which THREE of the following are best practices for securing the software supply chain in a CI/CD pipeline?

Accepted Answer

Sign images with Cosign after building. Cosign is a tool for signing container images using Sigstore, which provides non-repudiation and integrity verification. By signing images after building, you ensure that any tampering after the signature is applied can be detected, and consumers can verify the signature before deployment, establishing a chain of trust in the CI/CD pipeline.

Answer

Use a non-minimal base image to ensure all libraries are available

Answer

Store secrets in the Dockerfile as build args

Question 8

Which TWO of the following admission controllers are relevant for supply chain security in Kubernetes?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is correct because it intercepts Pod creation requests and validates container images against an external policy engine (e.g., OPA/Conftest) to enforce supply chain security controls, such as requiring images to be signed, from trusted registries, or with specific digests. This directly addresses the risk of deploying unverified or tampered images, a core supply chain threat.

Answer

MutatingAdmissionWebhook (for sidecar injection)

Answer

AlwaysPullImages

Answer

NodeRestriction

Question 9

You want to scan a container image for vulnerabilities before deploying it. Which command uses the Trivy tool to scan an image?

Accepted Answer

trivy image nginx:latest. Trivy uses the `image` subcommand to scan a container image for vulnerabilities. The correct syntax is `trivy image <image_name>`, which pulls the image (if not already present) and scans its OS packages and application dependencies against known vulnerability databases. Option B is correct because it follows this exact syntax.

Answer

trivy check nginx:latest

Answer

trivy fs nginx:latest

Answer

trivy scan nginx:latest

Question 10

A security team wants to ensure that only signed images are deployed in the cluster. They have set up an ImagePolicyWebhook admission controller. After configuring the webhook, they notice that pods with unsigned images are still being created. What is the most likely cause?

Accepted Answer

The ImagePolicyWebhook is not enabled in the kube-apiserver configuration. The ImagePolicyWebhook admission controller must be explicitly enabled in the kube-apiserver configuration via the `--enable-admission-plugins=ImagePolicyWebhook` flag. If it is not enabled, the kube-apiserver will not invoke the webhook at all, allowing unsigned images to be deployed regardless of the webhook's configuration.

Answer

The ImagePolicyWebhook is failing open due to a misconfigured failure policy

Answer

The container runtime does not support image signing

Answer

The images are signed but the signature is invalid

Question 11

A developer wants to ensure that a pod always uses a specific version of an image that cannot be changed without updating the manifest. Which image reference should be used?

Accepted Answer

myimage@sha256:abcdef.... (myimage@sha256:abcdef...) uses a digest-based image reference, which pins the image to an immutable content hash. This ensures that the exact same image is always pulled, regardless of tag updates, and any change to the image would require updating the manifest. This aligns with the requirement that the image version cannot be changed without modifying the manifest.

Answer

myimage:latest

Answer

myimage:v1.0

Answer

myimage:1.0.0

Question 12

You are auditing your cluster's supply chain security. You need to generate a Software Bill of Materials (SBOM) for a container image. Which tool should you use?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses a pluggable cataloger engine to extract package metadata (e.g., dpkg, RPM, APK, Python, Java) and outputs the SBOM in standard formats like CycloneDX or SPDX, directly addressing the requirement for supply chain security auditing.

Answer

Trivy

Answer

Kubesec

Answer

Checkov

Question 13

An administrator applies the following Kyverno policy to the cluster. What is the effect of this policy?

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: enforce
  rules:
  - name: check-runAsNonRoot
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Running as root is not allowed."
      pattern:
        spec:
          securityContext:
            runAsNonRoot: true

Accepted Answer

It denies all Pods that do not specify a security context. This Kyverno ClusterPolicy uses `validationFailureAction: enforce` and a `pattern` that requires `spec.securityContext.runAsNonRoot: true`. Because the pattern is a strict match, any Pod that does not explicitly set `runAsNonRoot: true` in its security context will fail validation and be denied. This includes Pods that omit the security context entirely, as the pattern requires the exact field to be present and set to `true`. Therefore, the policy denies all Pods that do not specify a security context with `runAsNonRoot: true`.

Answer

It allows Pods that run as root if they have a reason

Answer

It applies only to Pods in the default namespace

Answer

It only audits Pods and does not block them

Question 14

A security engineer wants to integrate image scanning into a CI/CD pipeline. They are using a tool that can scan the filesystem of the build context before building the image. Which tool is best suited for this purpose?

Accepted Answer

Trivy (trivy fs). Trivy's `fs` subcommand scans the filesystem of a build context (directory) for vulnerabilities and misconfigurations before the container image is built. This allows the security engineer to catch issues early in the CI/CD pipeline, such as vulnerable application dependencies or insecure configurations in Dockerfiles, without needing a built image. Trivy is purpose-built for this filesystem scanning use case, making it the correct choice.

Answer

Kubesec

Answer

Notary

Answer

Cosign

Question 15

You want to allow only images from a specific registry (e.g., myregistry.io) to be deployed in your cluster. Which tool or approach is best suited for this requirement?

Accepted Answer

Use OPA/Gatekeeper to create a constraint that checks the image registry. OPA/Gatekeeper allows you to define a ConstraintTemplate and a Constraint that validates the image registry in pod specs via a Rego rule. This approach enforces admission control at the API server level, rejecting any pod that references an image from an unauthorized registry before it is persisted in etcd.

Answer

Set up a NetworkPolicy to block traffic from other registries

Answer

Configure an ImagePolicyWebhook

Answer

Modify the kubelet configuration to only pull from a specific registry