CKS Supply Chain Security Practice Test 4 — 15 Questions

Question 1

Arrange the steps to secure etcd in a Kubernetes cluster.

Accepted Answer

Generate TLS certificates, then configure etcd with TLS, then restart etcd, then verify health and restrict network access. Securing etcd involves TLS configuration, restarting, health verification, and network restriction.

Answer

Configure etcd with TLS, then generate TLS certificates, then restart etcd, then verify health and restrict network access

Answer

Generate TLS certificates, then restart etcd, then configure etcd with TLS, then verify health and restrict network access

Answer

Restrict network access to etcd, then generate TLS certificates, then configure etcd with TLS, then restart etcd

Question 2

Match each Kubernetes API server flag to its security function.

Accepted Answer

--authorization-mode=RBAC: Enables RBAC authorization. Correct matches: --authorization-mode=RBAC enables RBAC; --anonymous-auth=false disables anonymous auth; --profiling=false disables profiling. Common confusions involve mixing authorization and authentication flags.

Answer

--authorization-mode=RBAC: Enables anonymous authentication

Answer

--anonymous-auth=false: Enables RBAC

Answer

--profiling=false: Enables audit logging

Question 3

You are tasked with ensuring that all container images in your cluster are scanned for vulnerabilities before being deployed. You have set up Trivy in your CI/CD pipeline and want to enforce that only images with no critical vulnerabilities are allowed. Which admission controller should you configure to reject pods using non-compliant images?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to evaluate container images against an external policy backend (e.g., Trivy) before they are admitted into the cluster. It intercepts pod creation requests, sends the image reference to an external webhook for validation, and rejects pods whose images contain critical vulnerabilities. This makes it the correct choice for enforcing image vulnerability policies at admission time.

Answer

ValidatingAdmissionWebhook

Answer

PodSecurityPolicy (PSP)

Answer

ResourceQuota

Question 4

Which of the following is a best practice for securing container images?

Accepted Answer

Use minimal base images like distroless or Alpine. Using minimal base images like distroless or Alpine significantly reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could contain vulnerabilities. Distroless images contain only the application and its runtime dependencies, while Alpine uses musl libc and BusyBox to keep the image size small and minimize the number of Common Vulnerabilities and Exposures (CVEs) that need to be patched.

Answer

Hardcode passwords in Dockerfile as environment variables for convenience

Answer

Use the latest tag for base images to get the newest features

Answer

Run containers as root to simplify permission management

Question 5

A security engineer wants to ensure that only images signed with a specific key are allowed to run in the cluster. Which tool can be used to sign container images?

Accepted Answer

cosign. Cosign is the correct tool because it is specifically designed for signing and verifying container images using cryptographic keys, integrating directly with OCI-compliant registries. It supports keyless signing via Fulcio and transparency logs via Rekor, making it the standard choice for enforcing image signature verification in Kubernetes admission controllers like Kyverno or OPA.

Answer

kubesec

Answer

syft

Answer

trivy

Question 6

A developer wants to create a Deployment that runs as a non-root user. Which YAML snippet correctly sets the security context to run the container with UID 1000?

Accepted Answer

spec.containers[].securityContext.runAsUser: 1000. `securityContext.runAsUser: 1000` explicitly sets the container's user ID to 1000, ensuring the container process runs as a non-root user. This is the direct way to enforce a specific UID in Kubernetes, meeting the developer's requirement to run as a non-root user.

Answer

spec.containers[].securityContext.runAsUser: 0

Answer

spec.containers[].securityContext.runAsNonRoot: true

Answer

spec.containers[].securityContext.runAsGroup: 1000

Question 7

A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is the correct tool because it allows you to define and enforce custom admission control policies via ConstraintTemplates and Constraints. You can create a policy that rejects any Pod using an image tagged with 'latest' by inspecting the `spec.containers[].image` field at admission time, which is not possible with native Kubernetes resources.

Answer

ResourceQuota

Answer

NetworkPolicy

Answer

PodSecurityPolicy (PSP)

Question 8

Developer A runs 'cosign verify --key cosign.pub myregistry/myimage:tag' and receives an error: 'No signatures found'. Developer B previously ran 'cosign sign --key cosign.key myregistry/myimage:tag'. What is the most likely cause of the verification failure?

Accepted Answer

The signing command failed to push the signature to the registry. The error 'No signatures found' indicates that the verification process could not locate any signature associated with the image in the registry. Since Developer B attempted to sign the image with 'cosign sign', the most likely cause is that the signing command failed to push the signature artifact (typically stored as a separate tag like 'myimage:sha256-<digest>.sig' in the same registry) to the registry. Without the signature being successfully uploaded, the 'cosign verify' command finds nothing to validate against the provided public key.

Answer

The image tag does not exist in the registry

Answer

Developer B used a different private key to sign than the public key used for verification

Answer

Developer A used the public key instead of the private key

Question 9

Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?

Accepted Answer

syft. Syft is a CLI tool purpose-built for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to extract package metadata (e.g., dpkg, RPM, APK, Python, Node.js) and outputs the SBOM in formats like CycloneDX or SPDX, which are the industry standards for supply chain transparency.

Answer

kubesec

Answer

trivy

Answer

cosign

Question 10

A DevOps engineer is setting up a CI/CD pipeline to scan container images for vulnerabilities. They want to fail the pipeline if any critical vulnerabilities are found. Which command should they use to scan the image and produce a JSON output that can be parsed?

Accepted Answer

trivy image --severity CRITICAL --format json myimage:tag. `trivy image` scans a container image. Use `--severity CRITICAL` to filter only critical vulnerabilities and `--format json` to produce machine-parseable JSON output. This lets the pipeline parse the JSON and fail on critical vulnerabilities. Note: `--output` specifies an output file path, not the report format.

Answer

trivy fs --severity CRITICAL --output json .

Answer

trivy image --format table myimage:tag

Answer

trivy image --severity HIGH myimage:tag

Question 11

You have configured Kyverno to enforce that all Pods must have an image from a trusted registry. However, a newly created Pod is not being rejected even though it uses an untrusted image. What is the most likely reason?

Accepted Answer

The Kyverno webhook is not invoked because the failure policy is set to Ignore or the resource is not matched by the policy's rules. Kyverno operates as a dynamic admission controller via a MutatingAdmissionWebhook or ValidatingAdmissionWebhook. If the webhook's failure policy is set to `Ignore`, the webhook will not block the Pod creation when it fails to invoke, and the Pod will be admitted. Additionally, if the policy's rules do not match the Pod (e.g., due to incorrect resource selection or namespace exclusion), the webhook will not be triggered, allowing untrusted images through.

Answer

Kyverno is not an admission controller; it only mutates resources

Answer

The Kyverno policy requires an external registry to compare images, which is unavailable

Answer

The Pod was created by a Deployment controller, which bypasses admission control

Question 12

Which of the following is a static analysis tool for Kubernetes manifests that can identify security misconfigurations?

Accepted Answer

kubesec. kubesec is a static analysis tool that scans Kubernetes manifests (YAML/JSON) and assigns a security score based on misconfigurations such as running containers as root, missing resource limits, or allowing privilege escalation. It operates offline without requiring a running cluster, making it a pure static analysis tool for identifying security issues in manifests before deployment.

Answer

Clair

Answer

OPA/Gatekeeper

Answer

Notary

Question 13

You need to ensure that all containers in your cluster run with a read-only root filesystem. Which field should be set in the container's security context?

Accepted Answer

readOnlyRootFilesystem: true. Setting `readOnlyRootFilesystem: true` in the container's security context mounts the container's root filesystem as read-only, preventing any writes to the root filesystem. This directly enforces the requirement that all containers run with a read-only root filesystem, which is a key supply chain security control to limit the impact of a compromised container.

Answer

allowPrivilegeEscalation: false

Answer

capabilities.drop: ['ALL']

Answer

runAsNonRoot: true

Question 14

Which two of the following are best practices for container image security? (Select TWO.)

Accepted Answer

Run containers as a non-root user. Running containers as a non-root user follows the principle of least privilege, reducing the risk of privilege escalation if the container is compromised. By default, Docker containers run as root, but using the USER directive in the Dockerfile or specifying a non-root user at runtime (e.g., --user 1000) limits the attacker's ability to modify system files or escape the container.

Answer

Maximize the number of layers to improve caching

Answer

Use the 'latest' tag for flexibility

Answer

Use old base images to avoid breaking changes

Question 15

Which three of the following are valid ways to enforce supply chain security in a Kubernetes cluster? (Select THREE.)

Accepted Answer

Use Cosign to sign images and configure verification in the cluster. A is correct because Cosign is a tool for signing container images using cryptographic keys, and by integrating it with Kubernetes admission controllers (e.g., via the Cosign webhook or Kyverno), the cluster can verify image signatures before allowing a pod to run. This ensures that only images signed by trusted parties are deployed, directly enforcing supply chain integrity.

Answer

Use ResourceQuota to limit the number of images that can be pulled

Answer

Use NetworkPolicy to block egress traffic to unknown registries