CKS Supply Chain Security Practice Test 7 — 15 Questions

Question 1

Which Kyverno policy action is used to automatically mutate a resource to add a sidecar container for security?

Accepted Answer

mutate. The `mutate` action in Kyverno is specifically designed to modify incoming Kubernetes resources before they are persisted. Adding a sidecar container (e.g., a security agent like Istio or Falco) is a classic mutation use case, where the policy patches the Pod spec to inject the container definition. This is distinct from validation, image verification, or resource generation.

Answer

validate

Answer

verifyImages

Answer

generate

Question 2

A CI pipeline fails with the error 'cosign: error: unable to verify image: no matching signatures' when running 'cosign verify --key pubkey.pem myregistry/myapp:latest'. The image was previously signed with a private key. What is the MOST likely cause?

Accepted Answer

The image tag was overwritten without signing. If the image tag was overwritten (e.g., pushed again without signing), the old signatures are lost and the new image is unsigned.

Answer

The public key is incorrect

Answer

The registry requires authentication

Answer

Cosign is not installed correctly

Question 3

A security best practice for Dockerfiles is to avoid hardcoded secrets. Which Dockerfile instruction is MOST likely to contain a hardcoded secret?

Accepted Answer

ENV. The ENV instruction in a Dockerfile is used to set environment variables, which are often used to store sensitive data like API keys, passwords, or tokens. Hardcoding secrets in ENV is a security risk because the values persist in the image layers and can be extracted by anyone with access to the image, violating the principle of least privilege and secret management best practices.

Answer

EXPOSE

Answer

RUN

Answer

FROM

Question 4

Which TWO are benefits of using a distroless base image over a full OS image like Ubuntu? (Select two.)

Accepted Answer

Smaller image size. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other OS utilities. This results in a significantly smaller image size compared to full OS images like Ubuntu, which include a complete userland and filesystem. Smaller images reduce storage costs, network transfer times, and container startup latency.

Answer

Faster image build times

Answer

Better compatibility with Kubernetes security contexts

Answer

Easier debugging

Question 5

Which THREE are valid methods to enforce that only images from a specific registry can be deployed in a Kubernetes cluster? (Select three.)

Accepted Answer

ImagePolicyWebhook admission controller. Option B (ImagePolicyWebhook admission controller) is correct because it is a built-in Kubernetes admission controller that calls an external HTTP webhook during admission to approve or reject a Pod based on its container image, so the webhook can enforce that images originate only from an allowed registry. Option C (Kyverno policy validating image registry) is correct because Kyverno is a Kubernetes-native admission policy engine whose validating policies can match on Pod specs and deny any container whose image field does not reference the approved registry. Option D (OPA/Gatekeeper constraint to validate registry) is correct because Gatekeeper runs OPA as a validating admission webhook and its ConstraintTemplates/Constraints (e.g., using Rego on input.review.object.spec.containers[_].image) can reject workloads that pull from unapproved registries. Option A (PodSecurityPolicy) is not correct because PSP only governed pod security attributes such as privileged mode, host namespaces, and volume types, not image registry provenance. Option E (NetworkPolicy) is not correct because it only controls L3/L4 network traffic (e.g., egress to registry IPs/ports) and cannot inspect or validate the image reference used in a Pod specification.

Answer

PodSecurityPolicy (PSP)

Answer

NetworkPolicy to restrict egress to registries

Question 6

Which TWO are recommended practices for securing a CI/CD pipeline that builds container images? (Select two.)

Accepted Answer

Scan images for vulnerabilities before pushing. Option B is correct because scanning images for vulnerabilities before pushing them to a registry catches known CVEs in OS packages and application dependencies early, preventing flawed artifacts from ever entering the pipeline's downstream stages or production. Option D is correct because signing images after building (e.g., with Docker Content Trust/Notary or Sigstore cosign) provides cryptographic provenance and integrity, letting admission controllers verify that only trusted, unmodified images are deployed. Option A is wrong because running containers as root violates least-privilege and dramatically increases the impact of a container escape; images should use a non-root USER. Option C is wrong because baking secrets into image layers as environment variables exposes them to anyone who can pull or inspect the image; secrets belong in a vault or secret manager injected at runtime. Option E is wrong because the mutable 'latest' tag makes builds non-reproducible and can silently pull a different, potentially compromised image; immutable, versioned tags or digests should be used.

Answer

Run containers as root for compatibility

Answer

Store secrets in the image as environment variables

Answer

Use the 'latest' tag for simplicity

Question 7

A security engineer wants to scan a container image for vulnerabilities using Trivy. Which command should they use?

Accepted Answer

trivy image . Trivy uses the `image` subcommand to scan a container image for vulnerabilities. The correct syntax is `trivy image `, which pulls the image (if not already present) and scans its layers against known vulnerability databases (e.g., NVD, Red Hat, Debian). This is the standard command for container image scanning in Trivy.

Answer

trivy scan <image-name>

Answer

trivy repo <image-name>

Answer

trivy fs <image-name>

Question 8

A DevOps engineer wants to enforce that all container images running in the cluster are signed using Cosign. Which Kubernetes admission controller is designed for this purpose?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to enforce that container images meet certain criteria, such as being signed with Cosign, by querying an external webhook service that validates image signatures before admitting a pod. It intercepts pod creation requests and checks the image references against a configured policy, making it the correct choice for this Cosign-based image signing enforcement scenario.

Answer

MutatingAdmissionWebhook

Answer

PodSecurityPolicy (deprecated)

Answer

ValidatingAdmissionWebhook

Question 9

An administrator runs 'kubectl describe pod secure-pod' and sees that the pod is in a Pending state with the event 'Error: ImagePullBackOff' and the message 'unauthorized: authentication required'. The image is stored in a private registry. What is the most likely cause?

Accepted Answer

Missing imagePullSecret in the pod spec or in the namespace's default service account. The error 'unauthorized: authentication required' indicates that the kubelet cannot authenticate to the private registry. Kubernetes requires an imagePullSecret, which contains registry credentials (typically a Docker config JSON), to be attached either directly to the pod spec or to the namespace's default service account. Without this secret, the kubelet cannot pull the image, resulting in the ImagePullBackOff state.

Answer

The registry requires TLS 1.3 but the kubelet uses TLS 1.2

Answer

The image tag is misspelled

Answer

The registry hostname is not resolvable

Question 10

Which of the following is a best practice for securing a Dockerfile?

Accepted Answer

Use a minimal base image like alpine. Using a minimal base image like Alpine reduces the attack surface by including only essential packages and libraries, minimizing the number of potential vulnerabilities. This aligns with the principle of least functionality and is a key supply chain security practice for container images.

Answer

Hardcode API keys as environment variables

Answer

Run the container as root to avoid permission issues

Answer

Use the latest tag for all images

Question 11

An administrator wants to ensure that only images from a specific registry (e.g., myregistry.internal) can run in the cluster. Which tool can be used to enforce this via admission control?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is a Kubernetes admission controller that can enforce policies on pod creation, including restricting which container image registries are allowed. By writing a ConstraintTemplate and Constraint that checks the image field against a whitelist of registries, Gatekeeper can reject any pod that attempts to use an image from an unauthorized source. This directly addresses the requirement to enforce registry restrictions at admission time.

Answer

Cosign

Answer

Notary

Answer

Trivy

Question 12

An organization wants to implement supply chain security by signing all container images and verifying them before deployment. Which combination of tools is appropriate?

Accepted Answer

Cosign and Kyverno. Cosign is the tool for signing container images and storing signatures in an OCI-compliant registry, while Kyverno is a Kubernetes admission controller that can enforce policies to verify those signatures before allowing pod deployment. Together, they implement the full supply chain security workflow: signing images at build time and verifying them at deploy time via Kyverno's `verifyImages` rule.

Answer

Snyk and OPA

Answer

Trivy and Syft

Answer

Clair and Notary

Question 13

A pod is running in a namespace that has a Kyverno policy requiring all images to come from a trusted registry. The pod is using an image from an untrusted registry. What will happen when the pod is created?

Accepted Answer

The pod creation will be rejected with an admission error. Kyverno operates as an admission controller in Kubernetes. When a pod is created, the Kyverno admission webhook intercepts the creation request and evaluates it against the configured policies. If the policy requires all images to come from a trusted registry and the pod uses an image from an untrusted registry, the admission webhook rejects the request, preventing the pod from being created. This results in an admission error, not a post-creation termination.

Answer

The pod will be created but immediately terminated

Answer

The pod will be created and run successfully

Answer

The pod will be created but the image will be replaced with a trusted one

Question 14

Which of the following is a static analysis tool for Kubernetes manifests?

Accepted Answer

Kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes manifests against a set of security best practices. It parses YAML or JSON resource definitions and scores them based on pod security contexts, container privilege escalation, and other runtime hardening rules, without executing the manifests.

Answer

Cosign

Answer

Trivy

Answer

Syft

Question 15

An administrator wants to ensure that a Deployment uses a specific image digest (SHA256) instead of a tag. Which field in the Deployment YAML should be modified?

Accepted Answer

spec.template.spec.containers[].image. The `image` field under `spec.template.spec.containers[]` is where you specify the container image, and to enforce immutable deployment, you replace the tag with the SHA256 digest (e.g., `nginx@sha256:abc123...`). This ensures the exact image content is used, preventing tag mutation or accidental updates.

Answer

spec.replicas

Answer

spec.template.spec.containers[].imagePullPolicy

Answer

spec.template.metadata.annotations