CKS Supply Chain Security Practice Test 4 — 15 Questions

Question 1

What is the purpose of using a non-root user in a container image?

Accepted Answer

To reduce the attack surface and limit potential damage if the container is compromised. Running containers as a non-root user reduces the attack surface by ensuring that even if an attacker exploits a vulnerability in the application, they do not gain root privileges inside the container. This limits the potential damage, such as modifying system binaries, escaping the container via kernel exploits, or accessing host resources. In Kubernetes, this is enforced by setting `securityContext.runAsNonRoot: true` or specifying a non-root user in the Dockerfile with `USER` directive.

Answer

To improve performance

Answer

To comply with Kubernetes requirements

Answer

To allow the container to bind to privileged ports

Question 2

A cluster administrator notices that a pod using an image from a public registry is failing to start. The image was signed with Cosign, and the cluster has an ImagePolicyWebhook configured to require signatures. The error message from the webhook indicates 'signature verification failed'. What is the most likely cause?

Accepted Answer

The public key used to verify the signature does not match the private key used to sign. The error 'signature verification failed' indicates that the webhook attempted to verify the image's signature but the cryptographic check did not pass. Since the image was signed with Cosign, the most likely cause is that the public key configured in the ImagePolicyWebhook does not correspond to the private key used to sign the image. Cosign uses public-key cryptography (typically ECDSA-P256 or RSA) where the signature can only be verified with the matching public key.

Answer

The image is not signed at all

Answer

The webhook is not reachable

Answer

The image tag is incorrect

Question 3

You are tasked with creating a Kubernetes admission controller that validates image signatures before allowing pods to run. Which admission controller should you configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to validate container image signatures against an external policy engine (e.g., OPA, Sigstore) before a pod is admitted. It intercepts pod creation requests and sends the image metadata to a webhook endpoint, which returns an allow/deny decision based on signature verification. This directly addresses the requirement to enforce image signature validation as part of supply chain security.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

NodeRestriction

Question 4

Which TWO of the following are benefits of using an SBOM (Software Bill of Materials) in supply chain security?

Accepted Answer

It helps in identifying known vulnerabilities in dependencies. An SBOM lists all components and dependencies in a software artifact, enabling teams to cross-reference against vulnerability databases (e.g., NVD) to identify known CVEs. This proactive identification is a core supply chain security practice, as mandated by frameworks like SLSA and EO 14028.

Answer

It allows for faster image pulls

Answer

It reduces the size of the container image

Answer

It automatically patches vulnerabilities

Question 5

Which TWO of the following are correct methods to verify a signed container image using Cosign?

Accepted Answer

cosign verify --fulcio-url https://fulcio.example.com myimage:latest. `cosign verify --fulcio-url` enables verification against a specified Fulcio certificate authority, which is part of Sigstore's keyless signing workflow. This command validates the signed image by checking the certificate chain from Fulcio, ensuring the signer's identity is trusted. It is a valid method for verifying container images when using keyless signing with Cosign.

Answer

cosign verify myimage:latest

Answer

cosign sign --key privkey.pem myimage:latest

Answer

cosign verify --insecure-ignore-sigs myimage:latest

Question 6

Which THREE of the following are best practices for writing Dockerfiles?

Accepted Answer

Minimize the number of layers. Minimizing the number of layers is a best practice because each instruction in a Dockerfile creates a new layer, and layers are stored and transferred as part of the image. Fewer layers reduce the overall image size, improve build and push/pull performance, and decrease the attack surface by limiting the number of intermediate filesystem snapshots that could contain sensitive data or cached artifacts.

Answer

Use the 'latest' tag for base images

Answer

Install all packages that might be needed for debugging

Question 7

An administrator runs 'trivy image --severity HIGH,CRITICAL myapp:v1.0' and sees no vulnerabilities. However, a security scan of the same image using a different tool reports several HIGH severity CVEs. What is the MOST likely reason for this discrepancy?

Accepted Answer

The image was scanned with an outdated vulnerability database. Trivy relies on a local vulnerability database (e.g., the `trivy-db` or `trivy-java-db`) that must be regularly updated to include the latest CVE entries. If the database is outdated, Trivy will not detect recently published HIGH or CRITICAL vulnerabilities, even if they exist in the image. This is the most likely reason for the discrepancy, as a different tool may have a more current database.

Answer

Trivy only scans the application layer and ignores the base image

Answer

Trivy cannot scan images stored in private registries

Answer

The other tool has false positives

Question 8

A security policy requires that all container images must be signed using Cosign. Which admission controller enforces signature verification at pod creation time?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is the correct choice because it is specifically designed to enforce image signature verification at pod creation time. It intercepts pod creation requests and queries an external webhook (e.g., a Cosign-based policy engine) to validate that the container image has a valid cryptographic signature before allowing the pod to be admitted. This directly meets the requirement for Cosign-based signature enforcement.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

ResourceQuota

Question 9

A developer wants to ensure the container image used in a Deployment is immutable. Which approach BEST guarantees that the exact same image is used every time, preventing tag mutation?

Accepted Answer

Use the image digest like 'myapp@sha256:abc123'. Using the image digest (e.g., `myapp@sha256:abc123`) guarantees immutability because the digest is a cryptographic hash of the image manifest. Unlike tags, which can be reassigned to different images, the digest uniquely identifies a specific image version, ensuring the exact same image is pulled every time regardless of tag changes.

Answer

Use a tag like 'v1.0-20231001' with a date

Answer

Use the tag 'v1.0' in the image field

Answer

Pin the image using a 'latest' tag

Question 10

Which tool is specifically designed to generate a Software Bill of Materials (SBOM) for container images?

Accepted Answer

Syft. Syft is an open-source CLI tool developed by Anchore specifically for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to catalog packages, libraries, and dependencies in formats such as CycloneDX and SPDX, making it the correct choice for this purpose.

Answer

Checkov

Answer

Cosign

Answer

Trivy

Question 11

A security engineer runs 'kubesec scan deployment.yaml' and receives a score of -1. What does this score indicate?

Accepted Answer

The scan failed due to an error or invalid YAML. In kubesec, a score of -1 indicates that the scan could not complete successfully, typically due to an error in the YAML file (e.g., invalid syntax, malformed structure) or a failure in the scanning process itself. Kubesec returns scores from 0 to 10 for valid deployments, where higher scores indicate better security; -1 is a special sentinel value reserved for scan failures, not a security assessment.

Answer

The deployment passed all security checks

Answer

The deployment is not secure and needs immediate attention

Answer

The deployment has critical vulnerabilities

Question 12

An OPA/Gatekeeper constraint is configured to allow only images from 'trusted-registry.io'. A pod is created with image 'trusted-registry.io/app:v1' but is denied. Which is the MOST likely cause?

Accepted Answer

The constraint uses regex and the image does not match the pattern. The most likely cause is that the OPA/Gatekeeper constraint uses a regex pattern to match allowed image registries, and the image 'trusted-registry.io/app:v1' does not match that pattern. Gatekeeper constraints often rely on Rego rules that check image strings against regex patterns; if the pattern is too restrictive or incorrectly defined (e.g., requiring a trailing slash or specific path), valid images can be denied. This is a common misconfiguration where the regex does not account for the full image reference format.

Answer

The constraint is only applied in the default namespace

Answer

The image tag is not pinned to a digest

Answer

The image is not signed

Question 13

Which of the following is a BEST practice for container images to reduce the attack surface?

Accepted Answer

Use minimal base images like distroless. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities that could be exploited. This drastically reduces the number of CVEs present in the image and limits the tools available to an attacker who gains code execution inside the container.

Answer

Use the 'latest' tag

Answer

Include debugging tools in the image

Answer

Run containers as root user

Question 14

An administrator wants to verify that an image was signed by a specific key before deploying. Which Cosign command should be used?

Accepted Answer

cosign verify --key mykey.pub myimage. The `cosign verify` command is used to verify the signature of a container image against a public key. By specifying `--key mykey.pub`, the administrator confirms that the image was signed with the corresponding private key before it can be deployed, ensuring supply chain integrity.

Answer

cosign sign --key mykey.pub myimage

Answer

cosign download myimage

Answer

cosign attest --predicate mypredicate myimage

Question 15

Which Kyverno policy action is used to automatically mutate a resource to add a sidecar container for security?

Accepted Answer

mutate. The `mutate` action in Kyverno is specifically designed to modify incoming Kubernetes resources before they are persisted. Adding a sidecar container (e.g., a security agent like Istio or Falco) is a classic mutation use case, where the policy patches the Pod spec to inject the container definition. This is distinct from validation, image verification, or resource generation.

Answer

validate

Answer

verifyImages

Answer

generate