CKS Supply Chain Security Practice Test 6 — 15 Questions

Question 1

A security engineer wants to integrate image scanning into a CI/CD pipeline. They are using a tool that can scan the filesystem of the build context before building the image. Which tool is best suited for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trivy (trivy fs). Trivy's `fs` subcommand scans the filesystem of a build context (directory) for vulnerabilities and misconfigurations before the container image is built. This allows the security engineer to catch issues early in the CI/CD pipeline, such as vulnerable application dependencies or insecure configurations in Dockerfiles, without needing a built image. Trivy is purpose-built for this filesystem scanning use case, making it the correct choice.

Answer

Kubesec

Answer

Notary

Answer

Cosign

Question 2

You want to allow only images from a specific registry (e.g., myregistry.io) to be deployed in your cluster. Which tool or approach is best suited for this requirement?

Accepted Answer

Use OPA/Gatekeeper to create a constraint that checks the image registry. OPA/Gatekeeper allows you to define a ConstraintTemplate and a Constraint that validates the image registry in pod specs via a Rego rule. This approach enforces admission control at the API server level, rejecting any pod that references an image from an unauthorized registry before it is persisted in etcd.

Answer

Set up a NetworkPolicy to block traffic from other registries

Answer

Configure an ImagePolicyWebhook

Answer

Modify the kubelet configuration to only pull from a specific registry

Question 3

What is the purpose of using a non-root user in a container image?

Accepted Answer

To reduce the attack surface and limit potential damage if the container is compromised. Running containers as a non-root user reduces the attack surface by ensuring that even if an attacker exploits a vulnerability in the application, they do not gain root privileges inside the container. This limits the potential damage, such as modifying system binaries, escaping the container via kernel exploits, or accessing host resources. In Kubernetes, this is enforced by setting `securityContext.runAsNonRoot: true` or specifying a non-root user in the Dockerfile with `USER` directive.

Answer

To improve performance

Answer

To comply with Kubernetes requirements

Answer

To allow the container to bind to privileged ports

Question 4

You are tasked with creating a Kubernetes admission controller that validates image signatures before allowing pods to run. Which admission controller should you configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to validate container image signatures against an external policy engine (e.g., OPA, Sigstore) before a pod is admitted. It intercepts pod creation requests and sends the image metadata to a webhook endpoint, which returns an allow/deny decision based on signature verification. This directly addresses the requirement to enforce image signature validation as part of supply chain security.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

NodeRestriction

Question 5

Which of the following is a static analysis tool for Kubernetes manifests that can be used to find misconfigurations?

Accepted Answer

Kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes manifests against a set of built-in security policies. It scans YAML or JSON resource definitions and assigns a risk score based on misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments. This makes it the correct choice for identifying misconfigurations in Kubernetes manifests without executing them.

Answer

Trivy

Answer

Syft

Answer

Cosign

Question 6

Which TWO of the following are benefits of using an SBOM (Software Bill of Materials) in supply chain security?

Accepted Answer

It helps in identifying known vulnerabilities in dependencies. An SBOM lists all components and dependencies in a software artifact, enabling teams to cross-reference against vulnerability databases (e.g., NVD) to identify known CVEs. This proactive identification is a core supply chain security practice, as mandated by frameworks like SLSA and EO 14028.

Answer

It allows for faster image pulls

Answer

It reduces the size of the container image

Answer

It automatically patches vulnerabilities

Question 7

Which THREE of the following are best practices for writing Dockerfiles?

Accepted Answer

Minimize the number of layers. Option A is correct because minimizing the number of layers reduces image size and improves build efficiency, typically achieved by combining related RUN commands with && and cleaning up caches in the same layer. Option C is correct because pinning base images to specific tags or SHA256 digests ensures reproducible, deterministic builds and protects against unexpected upstream changes or supply-chain attacks. Option E is correct because running containers as a non-root user (via the USER instruction) follows the principle of least privilege and limits the impact of a container breakout. Option B is wrong because the 'latest' tag is mutable and non-deterministic, leading to inconsistent builds and potential breakage. Option D is wrong because installing unnecessary debugging packages bloats the image, increases the attack surface, and violates the practice of keeping images minimal.

Answer

Use the 'latest' tag for base images

Answer

Install all packages that might be needed for debugging

Question 8

An administrator runs 'trivy image --severity HIGH,CRITICAL myapp:v1.0' and sees no vulnerabilities. However, a security scan of the same image using a different tool reports several HIGH severity CVEs. What is the MOST likely reason for this discrepancy?

Accepted Answer

The image was scanned with an outdated vulnerability database. Trivy relies on a local vulnerability database (e.g., the `trivy-db` or `trivy-java-db`) that must be regularly updated to include the latest CVE entries. If the database is outdated, Trivy will not detect recently published HIGH or CRITICAL vulnerabilities, even if they exist in the image. This is the most likely reason for the discrepancy, as a different tool may have a more current database.

Answer

Trivy only scans the application layer and ignores the base image

Answer

Trivy cannot scan images stored in private registries

Answer

The other tool has false positives

Question 9

A security policy requires that all container images must be signed using Cosign. Which admission controller enforces signature verification at pod creation time?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is the correct choice because it is specifically designed to enforce image signature verification at pod creation time. It intercepts pod creation requests and queries an external webhook (e.g., a Cosign-based policy engine) to validate that the container image has a valid cryptographic signature before allowing the pod to be admitted. This directly meets the requirement for Cosign-based signature enforcement.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

ResourceQuota

Question 10

A developer wants to ensure the container image used in a Deployment is immutable. Which approach BEST guarantees that the exact same image is used every time, preventing tag mutation?

Accepted Answer

Use the image digest like 'myapp@sha256:abc123'. Using the image digest (e.g., `myapp@sha256:abc123`) guarantees immutability because the digest is a cryptographic hash of the image manifest. Unlike tags, which can be reassigned to different images, the digest uniquely identifies a specific image version, ensuring the exact same image is pulled every time regardless of tag changes.

Answer

Use a tag like 'v1.0-20231001' with a date

Answer

Use the tag 'v1.0' in the image field

Answer

Pin the image using a 'latest' tag

Question 11

Which tool is specifically designed to generate a Software Bill of Materials (SBOM) for container images?

Accepted Answer

Syft. Syft is an open-source CLI tool developed by Anchore specifically for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to catalog packages, libraries, and dependencies in formats such as CycloneDX and SPDX, making it the correct choice for this purpose.

Answer

Checkov

Answer

Cosign

Answer

Trivy

Question 12

A security engineer runs 'kubesec scan deployment.yaml' and receives a score of -1. What does this score indicate?

Accepted Answer

The scan failed due to an error or invalid YAML. In kubesec, a score of -1 indicates that the scan could not complete successfully, typically due to an error in the YAML file (e.g., invalid syntax, malformed structure) or a failure in the scanning process itself. Kubesec returns scores from 0 to 10 for valid deployments, where higher scores indicate better security; -1 is a special sentinel value reserved for scan failures, not a security assessment.

Answer

The deployment passed all security checks

Answer

The deployment is not secure and needs immediate attention

Answer

The deployment has critical vulnerabilities

Question 13

An OPA/Gatekeeper constraint is configured to allow only images from 'trusted-registry.io'. A pod is created with image 'trusted-registry.io/app:v1' but is denied. Which is the MOST likely cause?

Accepted Answer

The constraint uses regex and the image does not match the pattern. The most likely cause is that the OPA/Gatekeeper constraint uses a regex pattern to match allowed image registries, and the image 'trusted-registry.io/app:v1' does not match that pattern. Gatekeeper constraints often rely on Rego rules that check image strings against regex patterns; if the pattern is too restrictive or incorrectly defined (e.g., requiring a trailing slash or specific path), valid images can be denied. This is a common misconfiguration where the regex does not account for the full image reference format.

Answer

The constraint is only applied in the default namespace

Answer

The image tag is not pinned to a digest

Answer

The image is not signed

Question 14

Which of the following is a BEST practice for container images to reduce the attack surface?

Accepted Answer

Use minimal base images like distroless. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities that could be exploited. This drastically reduces the number of CVEs present in the image and limits the tools available to an attacker who gains code execution inside the container.

Answer

Use the 'latest' tag

Answer

Include debugging tools in the image

Answer

Run containers as root user

Question 15

An administrator wants to verify that an image was signed by a specific key before deploying. Which Cosign command should be used?

Accepted Answer

cosign verify --key mykey.pub myimage. The `cosign verify` command is used to verify the signature of a container image against a public key. By specifying `--key mykey.pub`, the administrator confirms that the image was signed with the corresponding private key before it can be deployed, ensuring supply chain integrity.

Answer

cosign sign --key mykey.pub myimage

Answer

cosign download myimage

Answer

cosign attest --predicate mypredicate myimage