CKS Supply Chain Security Practice Test 6 — 15 Questions

Question 1

Which TWO of the following are valid methods to verify the integrity of a container image before deployment?

Accepted Answer

Use the image digest (SHA256) instead of a tag. Using the image digest (SHA256) provides a cryptographic hash of the image manifest, ensuring that the exact same image content is pulled every time, regardless of tag changes. This prevents tag mutability attacks where a malicious actor could overwrite a tag with a compromised image. The digest is immutable and uniquely identifies the image content.

Answer

Run a vulnerability scan on the image

Answer

Use the latest tag to ensure the most recent version

Answer

Generate an SBOM for the image

Question 2

Which THREE of the following are best practices for securing the software supply chain in Kubernetes?

Accepted Answer

Sign container images and verify signatures in the CI/CD pipeline. Signing container images with tools like Cosign or Notary and verifying those signatures in the CI/CD pipeline ensures image integrity and authenticity. This prevents tampered or unauthorized images from being deployed, which is a core supply chain security practice in Kubernetes.

Answer

Run containers as root to avoid permission issues

Answer

Use mutable tags like 'latest' for easier updates

Question 3

Which TWO of the following are tools that can be used to generate an SBOM for a container image?

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner that can also generate Software Bill of Materials (SBOM) for container images. It supports multiple output formats such as CycloneDX and SPDX, making it a valid tool for SBOM generation. Syft is specifically designed to generate SBOMs from container images and filesystems, producing output in formats like CycloneDX, SPDX, and Syft's own JSON format. Both tools are widely used in supply chain security workflows.

Answer

Cosign

Answer

Clair

Answer

Kubesec

Question 4

A developer wants to sign a container image using Cosign. Which command should they run after building and pushing the image to a registry?

Accepted Answer

cosign sign myrepo/myapp:latest. The `cosign sign` command is used to sign a container image and attach the signature to the image in the registry. After building and pushing the image, running `cosign sign myrepo/myapp:latest` generates a digital signature using a private key and stores it as an OCI artifact (e.g., `sha256-...sig`) in the same registry, enabling later verification of the image's integrity and origin.

Answer

cosign verify myrepo/myapp:latest

Answer

cosign attest myrepo/myapp:latest

Answer

cosign generate-key-pair

Question 5

An administrator wants to ensure that all containers in a deployment run as a non-root user. Which YAML snippet correctly sets the security context to run as user ID 1000?

Accepted Answer

securityContext:
  runAsUser: 1000. It correctly sets the security context at the pod or container level with the `runAsUser` field, which instructs the container runtime (e.g., containerd) to set the user ID to 1000 for the container's main process. This ensures the container does not run as root (UID 0), aligning with the principle of least privilege.

Answer

runAsUser: 1000

Answer

securityContext: { runAsNonRoot: true }

Answer

user: 1000

Question 6

A security engineer wants to enforce that all images in the cluster must come from a trusted registry 'trusted-registry.io'. They are using OPA/Gatekeeper. Which constraint template and constraint combination would achieve this?

Accepted Answer

A constraint template that checks 'spec.containers[*].image' starts with 'trusted-registry.io/' and a constraint that denies if it does not.. The constraint template must enforce that container images originate from the trusted registry by checking that the image string starts with 'trusted-registry.io/'. This ensures that only images from that specific registry are allowed, and the constraint denies any pod that does not meet this condition. OPA/Gatekeeper uses Rego policies to evaluate the image field and reject non-compliant resources during admission control.

Answer

A constraint template that checks 'spec.containers[*].image' contains 'trusted-registry.io' and a constraint that denies if it does.

Answer

A constraint template that allows all images and a constraint that audits violations.

Answer

A constraint template that checks 'spec.containers[*].image' equals 'trusted-registry.io' and a constraint that denies if it does not.

Question 7

Which tool is used to generate a Software Bill of Materials (SBOM) for a container image?

Accepted Answer

Syft. Syft is an open-source CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to extract package metadata (e.g., dpkg, RPM, APK, Python, Java) and outputs the SBOM in formats like CycloneDX or SPDX, which are the industry standards for supply chain transparency. This makes Syft the correct tool for generating an SBOM from a container image.

Answer

Kubesec

Answer

Checkov

Answer

Trivy

Question 8

A CI/CD pipeline builds a Docker image and pushes it to a registry. To ensure supply chain security, the pipeline should scan the image for vulnerabilities before deployment. Which of the following is the correct command to scan a local Docker image using Trivy?

Accepted Answer

trivy image myimage:latest. `trivy image` is the specific subcommand used to scan a local Docker image for vulnerabilities. Trivy requires the `image` subcommand followed by the image name and tag (e.g., `myimage:latest`) to analyze the image layers and report CVEs. This command directly integrates with the local Docker daemon to access the image.

Answer

trivy fs --image myimage:latest

Answer

trivy scan myimage:latest

Answer

trivy check myimage:latest

Question 9

Which admission controller is responsible for validating and modifying images based on an external webhook in Kubernetes?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to validate and modify container images by querying an external webhook before admitting a pod. It allows an external service to enforce image policies, such as checking image signatures or blocking untrusted registries, making it the correct answer for this scenario.

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Answer

ValidatingAdmissionWebhook

Question 10

A DevOps engineer wants to ensure that a container image is signed and the signature is verified before deployment. Which Cosign command verifies an image signature?

Accepted Answer

cosign verify. The `cosign verify` command is used to check the signature of a container image against the public key that was used to sign it. This ensures the image's integrity and authenticity before deployment, which is a core requirement of the CKS Supply Chain Security domain.

Answer

cosign sign

Answer

cosign check

Answer

cosign attest

Question 11

An administrator wants to perform static analysis on Kubernetes manifest files to find security misconfigurations. Which tool is specifically designed for this?

Accepted Answer

Kubesec. Kubesec (option C) is specifically designed for static analysis of Kubernetes manifest files to identify security misconfigurations. It evaluates YAML or JSON manifests against a set of built-in security best practices, such as ensuring containers run as non-root, avoiding privileged escalation, and setting read-only root filesystems. Unlike vulnerability scanners or image signers, Kubesec focuses purely on the configuration of Kubernetes resources before deployment.

Answer

Trivy

Answer

Cosign

Answer

Syft

Question 12

A pod is stuck in Pending state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate.' The pod does not specify any tolerations. What is the most likely cause?

Accepted Answer

The cluster only has control-plane nodes and the pod does not tolerate the control-plane taint. The error message '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate' indicates that the only node in the cluster is a control-plane node, which by default has the node-role.kubernetes.io/control-plane taint. Since the pod does not specify any tolerations, it cannot be scheduled on that node, leaving it stuck in Pending state. This is the most likely cause because the cluster lacks worker nodes, and the pod is not designed to run on the control-plane.

Answer

The pod's image pull secret is missing

Answer

The pod uses an untrusted image that was rejected by an admission webhook

Answer

The pod's resource requests exceed the available node capacity

Question 13

Which TWO of the following are valid methods to verify the integrity of a container image in a Kubernetes supply chain? (Select 2)

Accepted Answer

Signing the image with Cosign and verifying the signature before deployment. Cosign is a tool for signing container images using cryptographic keys, and verifying the signature before deployment ensures that the image has not been tampered with since it was signed. This provides integrity and authenticity in the software supply chain, as the signature can be validated against a trusted public key or a keyless identity (e.g., via Fulcio).

Answer

Running the container in a separate namespace

Answer

Scanning the image for vulnerabilities using Trivy

Answer

Using a base image with the latest tag

Question 14

Which THREE of the following are correct statements about Kubernetes admission controllers in the context of supply chain security? (Select 3)

Accepted Answer

Admission controllers are executed in a specific order that can affect the final state of the resource. Admission controllers are executed in a specific order: mutating controllers run first, then validating controllers. This ordering is critical because a mutating webhook can modify the resource before a validating webhook evaluates it, potentially bypassing intended policies if the order is not carefully managed. The Kubernetes API server processes admission controllers sequentially based on the order defined in the API server flags or the built-in chain, which directly affects the final resource state.

Answer

MutatingAdmissionWebhook can only modify pods, not other resources

Answer

OPA/Gatekeeper uses MutatingAdmissionWebhook to enforce policies

Question 15

Which TWO of the following tools can be used to generate or analyze SBOMs? (Select 2)

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate Software Bill of Materials (SBOMs) from container images and filesystems. It supports multiple output formats such as CycloneDX and SPDX, making it a direct choice for SBOM generation. Trivy, while primarily a vulnerability scanner, also includes built-in SBOM generation and analysis capabilities, allowing users to output SBOMs in CycloneDX or SPDX formats and to scan existing SBOMs for vulnerabilities.

Answer

Cosign

Answer

Kubesec

Answer

Checkov