CKS Supply Chain Security Practice Test 5 — 15 Questions

Question 1

Which two of the following are best practices for securing a CI/CD pipeline that builds and deploys container images? (Select TWO.)

Accepted Answer

Scan container images for vulnerabilities in the pipeline. Option A is correct because integrating automated image vulnerability scanning (e.g., Trivy, Clair, or Grype) into the pipeline catches known CVEs in base images and dependencies before the image is pushed or deployed, enabling fail-fast remediation. Option C is correct because signing images after building them (e.g., with Cosign/Notation using Sigstore or Docker Content Trust) establishes provenance and integrity, allowing admission controllers to verify signatures before deployment and preventing tampered or unauthorized images from running. Option B is not a best practice because secrets stored as plaintext environment variables in pipeline configuration can leak through logs, build artifacts, or repository access; a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager) or OIDC-based short-lived credentials should be used instead. Option D is wrong because running builds as root violates least privilege and increases the blast radius of a compromised build step; rootless builds (e.g., Buildah, Kaniko, or Docker rootless mode) are preferred. Option E is wrong because granting the pipeline service account all permissions violates least privilege and dramatically expands the impact of a supply-chain compromise; scoped, minimal RBAC roles should be assigned per stage.

Answer

Store secrets as environment variables in the pipeline configuration

Answer

Run the build process as root to avoid permission issues

Answer

Grant all permissions to the pipeline service account to avoid failures

Question 2

Which of the following is a best practice for securing container images in a CI/CD pipeline?

Accepted Answer

Using a minimal base image such as Alpine. Using a minimal base image like Alpine reduces the attack surface by minimizing the number of installed packages and potential vulnerabilities.

Answer

Using the 'latest' tag for all base images to ensure the newest features

Answer

Running the container as root to avoid permission issues

Answer

Installing all available packages to ensure the application has all dependencies

Question 3

An administrator runs 'trivy image myapp:1.0' and receives an output with several CRITICAL vulnerabilities. What is the best next step to ensure the image is secure before deployment?

Accepted Answer

Rebuild the image using updated base images and fix the identified vulnerabilities. The best practice for addressing container image vulnerabilities is to rebuild the image using updated base images and apply patches for the identified CVEs. Trivy reports vulnerabilities in the image layers, and simply deleting or ignoring them does not resolve the security issues; rebuilding with patched dependencies ensures the image is secure before deployment.

Answer

Delete the image entirely and do not deploy

Answer

Deploy the image anyway because vulnerabilities are common

Answer

Ignore the output and re-run the scan

Question 4

Which command is used to sign a container image with Cosign and store the signature in an OCI registry?

Accepted Answer

cosign sign --key cosign.key myimage:latest. `cosign sign --key cosign.key myimage:latest` is the standard Cosign command to sign a container image using a private key and store the resulting signature in the OCI registry as an attached artifact (e.g., a `.sig` layer). This command generates a signature that is automatically pushed to the same registry alongside the image, enabling verification without external storage.

Answer

cosign docker-sign myimage:latest

Answer

cosign verify --key cosign.pub myimage:latest

Answer

cosign attach signature --key cosign.key myimage:latest

Question 5

A Kubernetes cluster has Kyverno installed. A policy requires that all images come from a trusted registry 'trusted.example.com'. A Deployment uses the image 'nginx:latest'. When the Deployment is created, it is blocked. What Kyverno policy action is being used?

Accepted Answer

validate with failureAction: enforce. Kyverno's `validate` policy with `failureAction: enforce` is the mechanism that blocks resource creation when validation rules are violated. In this scenario, the policy checks that the image comes from `trusted.example.com`, and since `nginx:latest` does not match, the policy actively denies the Deployment, which is the behavior of `enforce` mode.

Answer

audit

Answer

mutate

Answer

generate

Question 6

A security policy requires that all container images use SHA-based digests instead of tags. Which approach ensures this in a Deployment YAML?

Accepted Answer

Use the image field with a digest, e.g., 'image: nginx@sha256:abc123'. Kubernetes supports using a SHA-based digest in the `image` field, which ensures the exact image content is pulled regardless of tag changes. By specifying the image as `nginx@sha256:abc123`, the container runtime fetches the image by its immutable digest, guaranteeing supply chain integrity and compliance with the security policy.

Answer

Use the 'image' field with a tag and also set 'digest' field

Answer

Set imagePullPolicy: Always and use tags

Answer

Set imagePullPolicy: IfNotPresent and use tags

Question 7

A CI/CD pipeline uses cosign attest to add an SBOM attestation to an image. Later, during deployment, which command verifies the attestation?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. `cosign verify-attestation` is the specific command designed to verify an in-toto attestation (such as an SBOM) attached to a container image. It checks the signature on the attestation using the provided public key (`--key cosign.pub`) and validates that the attestation's payload matches the image digest, ensuring the SBOM was generated and signed by the trusted party.

Answer

cosign verify --key cosign.pub myimage:latest

Answer

cosign attest --key cosign.key --predicate sbom.json myimage:latest

Answer

cosign download attestation myimage:latest

Question 8

Which of the following is a recommended Dockerfile best practice to improve container security?

Accepted Answer

Use a non-root user with USER directive. Running containers as root is a major security risk; if an attacker compromises the container, they gain root access to the container and potentially the host via kernel exploits. The USER directive in a Dockerfile switches the container's runtime user to a non-root user (e.g., USER 1000), reducing the blast radius by limiting privileges within the container. This aligns with the principle of least privilege and is a recommended best practice in the CKS exam for supply chain security.

Answer

Hardcode secrets in environment variables in the Dockerfile

Answer

Run the container as root to simplify permission management

Answer

Copy the entire host filesystem into the image

Question 9

Which tool can be used to perform static analysis of Kubernetes manifests for security issues?

Accepted Answer

kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes resource manifests against a set of built-in security best practices. It scans YAML or JSON manifests for common misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments, and returns a risk score. This makes it the correct choice for static analysis of Kubernetes manifests for security issues.

Answer

syft

Answer

cosign

Answer

trivy

Question 10

Which TWO of the following are valid methods to ensure only signed images are deployed in a Kubernetes cluster?

Accepted Answer

Configure ImagePolicyWebhook to require signatures. The ImagePolicyWebhook admission controller can be configured to reject pods that reference images without valid signatures. It works by sending an admission review request to an external webhook service (e.g., using Cosign or Notary) that validates the image signature before allowing the pod to be created. This enforces signature verification at admission time, preventing unsigned images from running in the cluster.

Answer

Set imagePullPolicy: Always

Answer

Run 'cosign verify' manually before every deployment

Answer

Use NodeRestriction admission controller

Question 11

Which THREE of the following are best practices for securing the software supply chain in a CI/CD pipeline?

Accepted Answer

Sign images with Cosign after building. Option A is correct because signing images with Cosign (part of the Sigstore project) after building produces a cryptographic signature that allows downstream consumers and admission controllers to verify image provenance and integrity, preventing tampered or unauthorized images from being deployed. Option B is correct because generating a Software Bill of Materials (SBOM) for each image provides a machine-readable inventory of components and dependencies, enabling rapid vulnerability triage and license/compliance auditing when new CVEs emerge. Option C is correct because scanning container images with Trivy detects known CVEs in OS packages and application dependencies before the image is promoted, catching vulnerabilities early in the CI/CD pipeline. Option D is incorrect because best practice favors minimal base images (e.g., distroless or Alpine) to reduce attack surface, not bloated images with unnecessary libraries. Option E is incorrect because storing secrets in a Dockerfile as build args embeds them in image layers and build history, exposing them to anyone who can pull the image; secrets should instead come from a vault or secret manager at runtime.

Answer

Use a non-minimal base image to ensure all libraries are available

Answer

Store secrets in the Dockerfile as build args

Question 12

Which TWO of the following admission controllers are relevant for supply chain security in Kubernetes?

Accepted Answer

ImagePolicyWebhook. ImagePolicyWebhook (B) is correct because it is the built-in admission controller that forwards pod image decisions to an external image policy service, enabling enforcement of trusted registries, signature verification, and vulnerability policies before a workload is admitted. ValidatingAdmissionWebhook (E) is correct because policy engines such as Kyverno and OPA Gatekeeper use it to validate resources against supply chain rules, for example rejecting images that lack a valid Cosign signature or that come from unapproved registries. MutatingAdmissionWebhook (A) is not the right answer here since its typical use is sidecar injection and defaulting, not supply chain verification. AlwaysPullImages (C) only forces image pulls on every pod start to avoid stale cached images and does not verify provenance or trust. NodeRestriction (D) limits what kubelets can modify on Node and Pod objects, which is a node-security control rather than a supply chain control.

Answer

MutatingAdmissionWebhook (for sidecar injection)

Answer

AlwaysPullImages

Answer

NodeRestriction

Question 13

You want to scan a container image for vulnerabilities before deploying it. Which command uses the Trivy tool to scan an image?

Accepted Answer

trivy image nginx:latest. Trivy uses the `image` subcommand to scan a container image for vulnerabilities. The correct syntax is `trivy image <image_name>`, which pulls the image (if not already present) and scans its OS packages and application dependencies against known vulnerability databases. Option B is correct because it follows this exact syntax.

Answer

trivy check nginx:latest

Answer

trivy fs nginx:latest

Answer

trivy scan nginx:latest

Question 14

A developer wants to ensure that a pod always uses a specific version of an image that cannot be changed without updating the manifest. Which image reference should be used?

Accepted Answer

myimage@sha256:abcdef.... (myimage@sha256:abcdef...) uses a digest-based image reference, which pins the image to an immutable content hash. This ensures that the exact same image is always pulled, regardless of tag updates, and any change to the image would require updating the manifest. This aligns with the requirement that the image version cannot be changed without modifying the manifest.

Answer

myimage:latest

Answer

myimage:v1.0

Answer

myimage:1.0.0

Question 15

You are auditing your cluster's supply chain security. You need to generate a Software Bill of Materials (SBOM) for a container image. Which tool should you use?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses a pluggable cataloger engine to extract package metadata (e.g., dpkg, RPM, APK, Python, Java) and outputs the SBOM in standard formats like CycloneDX or SPDX, directly addressing the requirement for supply chain security auditing.

Answer

Trivy

Answer

Kubesec

Answer

Checkov