CKS Supply Chain Security Practice Test 7 — 15 Questions

Question 1

A security admin runs 'trivy image --severity CRITICAL,HIGH myrepo/myapp:latest' and sees many CVEs. The admin wants to ensure that only images with no CRITICAL or HIGH severity vulnerabilities are deployed to the cluster. Which admission controller should be configured to enforce this policy?

Accepted Answer

ImagePolicyWebhook. An ImagePolicyWebhook admission controller can be used to evaluate container images against a policy, such as requiring scan results to be free of specified vulnerabilities. Options A, B, and D are not designed for this purpose.

Answer

PodSecurityPolicy

Answer

ValidatingAdmissionWebhook

Answer

MutatingAdmissionWebhook

Question 2

A developer wants to sign a container image using Cosign. Which command should they run after building and pushing the image to a registry?

Accepted Answer

cosign sign myrepo/myapp:latest. The cosign sign command signs a container image and generates a signature. The other options are incorrect commands or actions.

Answer

cosign verify myrepo/myapp:latest

Answer

cosign attest myrepo/myapp:latest

Answer

cosign generate-key-pair

Question 3

An administrator wants to ensure that all containers in a deployment run as a non-root user. Which YAML snippet correctly sets the security context to run as user ID 1000?

Accepted Answer

securityContext:
  runAsUser: 1000. The correct field is 'securityContext.runAsUser: 1000' at the pod or container level. Option C is the only one with the correct syntax.

Answer

runAsUser: 1000

Answer

securityContext: { runAsNonRoot: true }

Answer

user: 1000

Question 4

A security engineer wants to enforce that all images in the cluster must come from a trusted registry 'trusted-registry.io'. They are using OPA/Gatekeeper. Which constraint template and constraint combination would achieve this?

Accepted Answer

A constraint template that checks 'spec.containers[*].image' starts with 'trusted-registry.io/' and a constraint that denies if it does not.. A Gatekeeper constraint template that validates image registries against an allowed list is appropriate. The other options either allow any registry or use incorrect logic.

Answer

A constraint template that checks 'spec.containers[*].image' contains 'trusted-registry.io' and a constraint that denies if it does.

Answer

A constraint template that allows all images and a constraint that audits violations.

Answer

A constraint template that checks 'spec.containers[*].image' equals 'trusted-registry.io' and a constraint that denies if it does not.

Question 5

Which tool is used to generate a Software Bill of Materials (SBOM) for a container image?

Accepted Answer

Syft. Syft is a tool specifically designed for generating SBOMs from container images and filesystems.

Answer

Kubesec

Answer

Checkov

Answer

Trivy

Question 6

A CI/CD pipeline builds a Docker image and pushes it to a registry. To ensure supply chain security, the pipeline should scan the image for vulnerabilities before deployment. Which of the following is the correct command to scan a local Docker image using Trivy?

Accepted Answer

trivy image myimage:latest. The correct command to scan a local image with Trivy is 'trivy image <image-name>'. The other options are incorrect flags or commands.

Answer

trivy fs --image myimage:latest

Answer

trivy scan myimage:latest

Answer

trivy check myimage:latest

Question 7

A Kyverno policy is written to require all images to use SHA256 digests instead of tags. The policy uses a 'validate' rule with 'pattern' on 'spec.containers[*].image'. Which pattern would match an image reference like 'registry.example.com/myapp@sha256:abc123...'?

Accepted Answer

"*@sha256:*". The policy should use a regular expression that requires an '@sha256:' in the image field. Option C correctly matches the digest format.

Answer

"*@sha256:*"

Answer

"*@*"

Answer

"*:*"

Question 8

Which admission controller is responsible for validating and modifying images based on an external webhook in Kubernetes?

Accepted Answer

ImagePolicyWebhook. ImagePolicyWebhook is the dedicated admission controller for image policy enforcement. The others serve different purposes.

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Answer

ValidatingAdmissionWebhook

Question 9

A DevOps engineer wants to ensure that a container image is signed and the signature is verified before deployment. Which Cosign command verifies an image signature?

Accepted Answer

cosign verify. cosign verify is the correct command to verify an image signature. The other options are for signing or other operations.

Answer

cosign sign

Answer

cosign check

Answer

cosign attest

Question 10

An administrator wants to perform static analysis on Kubernetes manifest files to find security misconfigurations. Which tool is specifically designed for this?

Accepted Answer

Kubesec. Kubesec is a static analysis tool for Kubernetes resources. Checkov and others serve similar but broader purposes, but Kubesec is specifically named.

Answer

Trivy

Answer

Cosign

Answer

Syft

Question 11

A pod is stuck in Pending state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate.' The pod does not specify any tolerations. What is the most likely cause?

Accepted Answer

The cluster only has control-plane nodes and the pod does not tolerate the control-plane taint. The taint on the control-plane node prevents pods without tolerations from being scheduled. The pod must either tolerate the taint or be scheduled to a worker node that does not have this taint.

Answer

The pod's image pull secret is missing

Answer

The pod uses an untrusted image that was rejected by an admission webhook

Answer

The pod's resource requests exceed the available node capacity

Question 12

Which of the following is a best practice when writing a Dockerfile for a containerized application?

Accepted Answer

Use a minimal base image such as distroless or alpine. Using a minimal base image reduces the attack surface. The other options are not best practices.

Answer

Run the application as the root user for file permissions

Answer

Hardcode credentials in the Dockerfile for convenience

Answer

Use the latest tag for the base image to get the newest features

Question 13

Which TWO of the following are valid methods to verify the integrity of a container image in a Kubernetes supply chain? (Select 2)

Accepted Answer

Signing the image with Cosign and verifying the signature before deployment. Image signing with Cosign and using SHA digests are both methods to verify image integrity. Scanning for CVEs does not verify integrity but finds vulnerabilities. Namespace isolation is not related to image verification.

Answer

Running the container in a separate namespace

Answer

Scanning the image for vulnerabilities using Trivy

Answer

Using a base image with the latest tag

Question 14

Which THREE of the following are correct statements about Kubernetes admission controllers in the context of supply chain security? (Select 3)

Accepted Answer

Admission controllers are executed in a specific order that can affect the final state of the resource. Admission controllers can be chained, ImagePolicyWebhook is for image validation, and ValidatingAdmissionWebhooks can enforce custom policies. MutatingAdmissionWebhooks can modify pods but are not the only way to inject sidecars. OPA/Gatekeeper uses constraint templates for policy.

Answer

MutatingAdmissionWebhook can only modify pods, not other resources

Answer

OPA/Gatekeeper uses MutatingAdmissionWebhook to enforce policies

Question 15

Which TWO of the following tools can be used to generate or analyze SBOMs? (Select 2)

Accepted Answer

Syft. Syft generates SBOMs, and Trivy can also generate SBOMs (in addition to vulnerability scanning). Cosign is for signing, Kubesec is for manifest analysis, and Checkov is for infrastructure-as-code scanning.

Answer

Cosign

Answer

Kubesec

Answer

Checkov