CKS Supply Chain Security Practice Test 5 — 15 Questions

Question 1

An administrator runs 'trivy image --severity HIGH,CRITICAL myapp:v1.0' and sees no vulnerabilities. However, a security scan of the same image using a different tool reports several HIGH severity CVEs. What is the MOST likely reason for this discrepancy?

Accepted Answer

The image was scanned with an outdated vulnerability database. Trivy uses different vulnerability databases and may not include all sources (e.g., Red Hat OVAL, OSV). The other tool might use a broader set of databases, explaining the additional found CVEs.

Answer

Trivy only scans the application layer and ignores the base image

Answer

Trivy cannot scan images stored in private registries

Answer

The other tool has false positives

Question 2

A security policy requires that all container images must be signed using Cosign. Which admission controller enforces signature verification at pod creation time?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to verify image signatures and policies via an external webhook.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

ResourceQuota

Question 3

A developer wants to ensure the container image used in a Deployment is immutable. Which approach BEST guarantees that the exact same image is used every time, preventing tag mutation?

Accepted Answer

Use the image digest like 'myapp@sha256:abc123'. Using a digest (SHA256) ensures that the image identifier is unique to the content, making it immutable. Tags like 'v1.0' can be overwritten.

Answer

Use a tag like 'v1.0-20231001' with a date

Answer

Use the tag 'v1.0' in the image field

Answer

Pin the image using a 'latest' tag

Question 4

Which tool is specifically designed to generate a Software Bill of Materials (SBOM) for container images?

Accepted Answer

Syft. Syft is an open-source tool that generates SBOMs from container images and filesystems.

Answer

Checkov

Answer

Cosign

Answer

Trivy

Question 5

A security engineer runs 'kubesec scan deployment.yaml' and receives a score of -1. What does this score indicate?

Accepted Answer

The scan failed due to an error or invalid YAML. Kubesec uses a scoring system where -1 indicates a failed scan due to an error or misconfiguration in the file.

Answer

The deployment passed all security checks

Answer

The deployment is not secure and needs immediate attention

Answer

The deployment has critical vulnerabilities

Question 6

An OPA/Gatekeeper constraint is configured to allow only images from 'trusted-registry.io'. A pod is created with image 'trusted-registry.io/app:v1' but is denied. Which is the MOST likely cause?

Accepted Answer

The constraint uses regex and the image does not match the pattern. Gatekeeper constraints can enforce specific registries. If the constraint does not match the exact registry name (e.g., missing port or path), the pod will be denied.

Answer

The constraint is only applied in the default namespace

Answer

The image tag is not pinned to a digest

Answer

The image is not signed

Question 7

Which of the following is a BEST practice for container images to reduce the attack surface?

Accepted Answer

Use minimal base images like distroless. Using minimal base images like distroless or Alpine reduces the number of packages and thus the attack surface.

Answer

Use the 'latest' tag

Answer

Include debugging tools in the image

Answer

Run containers as root user

Question 8

An administrator wants to verify that an image was signed by a specific key before deploying. Which Cosign command should be used?

Accepted Answer

cosign verify --key mykey.pub myimage. The 'cosign verify' command checks the signature against a public key and verifies the image.

Answer

cosign sign --key mykey.pub myimage

Answer

cosign download myimage

Answer

cosign attest --predicate mypredicate myimage

Question 9

Which Kyverno policy action is used to automatically mutate a resource to add a sidecar container for security?

Accepted Answer

mutate. Kyverno's 'mutate' rule can modify resources during admission, such as injecting a sidecar container.

Answer

validate

Answer

verifyImages

Answer

generate

Question 10

A CI pipeline fails with the error 'cosign: error: unable to verify image: no matching signatures' when running 'cosign verify --key pubkey.pem myregistry/myapp:latest'. The image was previously signed with a private key. What is the MOST likely cause?

Accepted Answer

The image tag was overwritten without signing. If the image tag was overwritten (e.g., pushed again without signing), the old signatures are lost and the new image is unsigned.

Answer

The public key is incorrect

Answer

The registry requires authentication

Answer

Cosign is not installed correctly

Question 11

Which admission controller runs FIRST in the Kubernetes admission flow?

Accepted Answer

MutatingAdmissionWebhook. The MutatingAdmissionWebhook runs first, before ValidatingAdmissionWebhook, as mutations must be applied before validation.

Answer

ResourceQuota

Answer

ValidatingAdmissionWebhook

Answer

ImagePolicyWebhook

Question 12

A security best practice for Dockerfiles is to avoid hardcoded secrets. Which Dockerfile instruction is MOST likely to contain a hardcoded secret?

Accepted Answer

ENV. The 'ENV' instruction can set environment variables, but secrets should not be hardcoded. However, 'ARG' is often used for passing build-time variables, but can also contain secrets if not careful. The most common culprit is 'ENV' with a secret value.

Answer

EXPOSE

Answer

RUN

Answer

FROM

Question 13

Which TWO are benefits of using a distroless base image over a full OS image like Ubuntu? (Select two.)

Accepted Answer

Smaller image size. Distroless images reduce attack surface and image size by including only necessary libraries.

Answer

Faster image build times

Answer

Better compatibility with Kubernetes security contexts

Answer

Easier debugging

Question 14

Which THREE are valid methods to enforce that only images from a specific registry can be deployed in a Kubernetes cluster? (Select three.)

Accepted Answer

ImagePolicyWebhook admission controller. OPA/Gatekeeper, ImagePolicyWebhook, and Kyverno can enforce registry allowlists. PodSecurityPolicy is deprecated and removed; NetworkPolicy does not control image sources.

Answer

PodSecurityPolicy (PSP)

Answer

NetworkPolicy to restrict egress to registries

Question 15

Which TWO are recommended practices for securing a CI/CD pipeline that builds container images? (Select two.)

Accepted Answer

Scan images for vulnerabilities before pushing. Scanning images for vulnerabilities and signing images are key supply chain security practices.

Answer

Run containers as root for compatibility

Answer

Store secrets in the image as environment variables

Answer

Use the 'latest' tag for simplicity