CKS Supply Chain Security Practice Test 5 — 15 Questions

Question 1

A CI pipeline fails with the error 'cosign: error: unable to verify image: no matching signatures' when running 'cosign verify --key pubkey.pem myregistry/myapp:latest'. The image was previously signed with a private key. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The image tag was overwritten without signing. If the image tag was overwritten (e.g., pushed again without signing), the old signatures are lost and the new image is unsigned.

Answer

The public key is incorrect

Answer

The registry requires authentication

Answer

Cosign is not installed correctly

Question 2

Which admission controller runs FIRST in the Kubernetes admission flow?

Accepted Answer

MutatingAdmissionWebhook. MutatingAdmissionWebhook is correct because in the Kubernetes admission flow, mutating admission controllers run before validating ones. The API server processes admission controllers in a specific order: mutating webhooks first, then object validation, then validating webhooks. This ensures that any modifications to the object (e.g., sidecar injection) are applied before validation checks occur.

Answer

ResourceQuota

Answer

ValidatingAdmissionWebhook

Answer

ImagePolicyWebhook

Question 3

A security best practice for Dockerfiles is to avoid hardcoded secrets. Which Dockerfile instruction is MOST likely to contain a hardcoded secret?

Accepted Answer

ENV. The ENV instruction in a Dockerfile is used to set environment variables, which are often used to store sensitive data like API keys, passwords, or tokens. Hardcoding secrets in ENV is a security risk because the values persist in the image layers and can be extracted by anyone with access to the image, violating the principle of least privilege and secret management best practices.

Answer

EXPOSE

Answer

RUN

Answer

FROM

Question 4

Which TWO are benefits of using a distroless base image over a full OS image like Ubuntu? (Select two.)

Accepted Answer

Smaller image size. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other OS utilities. This results in a significantly smaller image size compared to full OS images like Ubuntu, which include a complete userland and filesystem. Smaller images reduce storage costs, network transfer times, and container startup latency.

Answer

Faster image build times

Answer

Better compatibility with Kubernetes security contexts

Answer

Easier debugging

Question 5

Which THREE are valid methods to enforce that only images from a specific registry can be deployed in a Kubernetes cluster? (Select three.)

Accepted Answer

ImagePolicyWebhook admission controller. The ImagePolicyWebhook admission controller intercepts all Pod creation requests and validates the container image against an external webhook that enforces a policy, such as allowing only images from a specific registry. This is a native Kubernetes mechanism for admission control, making it a valid method to restrict image sources.

Answer

PodSecurityPolicy (PSP)

Answer

NetworkPolicy to restrict egress to registries

Question 6

Which TWO are recommended practices for securing a CI/CD pipeline that builds container images? (Select two.)

Accepted Answer

Scan images for vulnerabilities before pushing. Scanning container images for vulnerabilities before pushing them to a registry is a critical security practice in a CI/CD pipeline. It ensures that known Common Vulnerabilities and Exposures (CVEs) in base images or installed packages are identified and remediated before deployment, reducing the attack surface. Tools like Trivy, Clair, or Anchore Grype integrate into the pipeline to fail builds if critical vulnerabilities are found, enforcing a security gate.

Answer

Run containers as root for compatibility

Answer

Store secrets in the image as environment variables

Answer

Use the 'latest' tag for simplicity

Question 7

A security engineer wants to scan a container image for vulnerabilities using Trivy. Which command should they use?

Accepted Answer

trivy image . Trivy uses the `image` subcommand to scan a container image for vulnerabilities. The correct syntax is `trivy image `, which pulls the image (if not already present) and scans its layers against known vulnerability databases (e.g., NVD, Red Hat, Debian). This is the standard command for container image scanning in Trivy.

Answer

trivy scan <image-name>

Answer

trivy repo <image-name>

Answer

trivy fs <image-name>

Question 8

Which of the following is a best practice for securing a Dockerfile?

Accepted Answer

Use a minimal base image like alpine. Using a minimal base image like Alpine reduces the attack surface by including only essential packages and libraries, minimizing the number of potential vulnerabilities. This aligns with the principle of least functionality and is a key supply chain security practice for container images.

Answer

Hardcode API keys as environment variables

Answer

Run the container as root to avoid permission issues

Answer

Use the latest tag for all images

Question 9

An administrator wants to ensure that only images from a specific registry (e.g., myregistry.internal) can run in the cluster. Which tool can be used to enforce this via admission control?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is a Kubernetes admission controller that can enforce policies on pod creation, including restricting which container image registries are allowed. By writing a ConstraintTemplate and Constraint that checks the image field against a whitelist of registries, Gatekeeper can reject any pod that attempts to use an image from an unauthorized source. This directly addresses the requirement to enforce registry restrictions at admission time.

Answer

Cosign

Answer

Notary

Answer

Trivy

Question 10

A security team wants to generate an SBOM for a container image. Which tool should they use?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It can output SBOMs in multiple formats, including CycloneDX and SPDX, which are the industry-standard formats for SBOMs. This makes Syft the correct choice for the security team's requirement.

Answer

Clair

Answer

Trivy

Answer

Cosign

Question 11

An administrator runs 'kubectl run test-pod --image=nginx:latest' and the pod fails to start. The event log shows 'ImagePullBackOff' with error 'manifest for nginx:latest not found: manifest unknown'. The image 'nginx:latest' exists in the registry. What is the most likely cause?

Accepted Answer

The image tag is misspelled or points to a non-existent tag. If the image 'nginx:latest' exists in the registry, the manifest for that tag must exist. The error 'manifest for nginx:latest not found: manifest unknown' indicates that the tag does not exist in the registry. Therefore, the given stem invalidates option C. None of the provided options correctly address the scenario as described.

Answer

The pod is running in a different namespace

Answer

The registry requires authentication

Answer

The image is a multi-architecture image and the node does not support the required architecture

Question 12

Which admission controller is responsible for invoking external webhooks to validate or mutate resources?

Accepted Answer

ValidatingAdmissionWebhook. The ValidatingAdmissionWebhook admission controller is responsible for invoking external webhooks that validate resources. While there is a separate controller, MutatingAdmissionWebhook, for mutation, the question's inclusion of 'or mutate' can be misleading. The correct answer is ValidatingAdmissionWebhook because it handles validation, and the phrase 'validate or mutate' is meant to test the candidate's ability to distinguish between the two controllers.

Answer

ImagePolicyWebhook

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Question 13

An organization wants to implement supply chain security by signing all container images and verifying them before deployment. Which combination of tools is appropriate?

Accepted Answer

Cosign and Kyverno. Cosign is the tool for signing container images and storing signatures in an OCI-compliant registry, while Kyverno is a Kubernetes admission controller that can enforce policies to verify those signatures before allowing pod deployment. Together, they implement the full supply chain security workflow: signing images at build time and verifying them at deploy time via Kyverno's `verifyImages` rule.

Answer

Snyk and OPA

Answer

Trivy and Syft

Answer

Clair and Notary

Question 14

Which of the following is a static analysis tool for Kubernetes manifests?

Accepted Answer

Kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes manifests against a set of security best practices. It parses YAML or JSON resource definitions and scores them based on pod security contexts, container privilege escalation, and other runtime hardening rules, without executing the manifests.

Answer

Cosign

Answer

Trivy

Answer

Syft

Question 15

An administrator wants to ensure that a Deployment uses a specific image digest (SHA256) instead of a tag. Which field in the Deployment YAML should be modified?

Accepted Answer

spec.template.spec.containers[].image. The `image` field under `spec.template.spec.containers[]` is where you specify the container image, and to enforce immutable deployment, you replace the tag with the SHA256 digest (e.g., `nginx@sha256:abc123...`). This ensures the exact image content is used, preventing tag mutation or accidental updates.

Answer

spec.replicas

Answer

spec.template.spec.containers[].imagePullPolicy

Answer

spec.template.metadata.annotations