CKS Supply Chain Security Practice Test 7 — 15 Questions

Question 1

An administrator wants to ensure that only images from a trusted registry 'myregistry.io' can run in the cluster. Which admission controller should be configured?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller enforces that only images from a trusted registry (e.g., 'myregistry.io') can run. It does this by querying an external webhook to validate the image source against a policy. Options A, B, and D are incorrect: NodeRestriction restricts node API access, MutatingAdmissionWebhook can mutate pods but is not specifically designed for image registry control, and PodSecurity handles pod security contexts, not image source validation.

Answer

NodeRestriction

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Question 2

Which command is used with Cosign to sign a container image?

Accepted Answer

cosign sign . The `cosign sign ` command is used to sign a container image by attaching a digital signature to the image manifest in the container registry. This signature, typically stored as a separate tag or in an OCI artifact, allows verification of the image's origin and integrity using the corresponding public key.

Answer

cosign verify <image>

Answer

cosign attest <image>

Answer

cosign generate <image>

Question 3

A DevOps engineer runs 'trivy image myapp:latest' and finds a critical CVE in the base image. Which Dockerfile change would BEST address this?

Accepted Answer

Switch to a distroless base image with a SHA digest. Switching to a distroless base image with a SHA digest (e.g., gcr.io/distroless/base@sha256:...) eliminates the vulnerable packages present in the original base image because distroless images contain only the minimal runtime dependencies (e.g., glibc, libssl) and no package manager or shell, drastically reducing the attack surface. Pinning the image by SHA digest ensures immutability and prevents the base image from being silently updated to a version that reintroduces the same or different vulnerabilities, which is critical for supply chain security.

Answer

Use an Alpine base image with the latest tag

Answer

Set USER root in the Dockerfile

Answer

Add a non-root user in the Dockerfile

Question 4

An OPA/Gatekeeper constraint is configured to require all container images to be from a specific registry. A user creates a Pod with image 'gcr.io/myimage:v1'. Which admission controller will first reject this Pod?

Accepted Answer

ValidatingAdmissionWebhook. OPA/Gatekeeper enforces policies via ValidatingAdmissionWebhooks, which intercept admission requests and validate them against constraints. When a Pod with image 'gcr.io/myimage:v1' is created, the ValidatingAdmissionWebhook (C) processes the request, checks the constraint requiring images from a specific registry, and rejects the Pod if the image does not match. This is the correct admission controller because Gatekeeper uses ValidatingAdmissionWebhooks to enforce its constraint templates.

Answer

PodSecurity

Answer

ImagePolicyWebhook

Answer

MutatingAdmissionWebhook

Question 5

A security policy requires that all container images must have a signed attestation. Which Cosign command would an admin add to the CI pipeline to create this attestation?

Accepted Answer

cosign attest --type custom --predicate . The `cosign attest` command is specifically designed to create an in-toto attestation for a container image, attaching a signed predicate (e.g., a SLSA provenance file) that satisfies the policy requirement for a signed attestation. The `--type custom` flag allows specifying a custom predicate type, and `--predicate ` provides the attestation payload, which is then signed and stored in the image's OCI manifest as an attached attestation.

Answer

cosign verify-attestation <image>

Answer

cosign sign --key

Answer

cosign download attestation <image>

Question 6

Which tool is used to generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses a pluggable cataloger system to extract package metadata (e.g., dpkg, RPM, APK, Python, Java JARs) and outputs the SBOM in formats like CycloneDX or SPDX, which are the standard formats for supply chain transparency.

Answer

Clair

Answer

Kubesec

Answer

Trivy

Question 7

An admin runs 'kubectl run test-pod --image=nginx:latest' and the Pod is created but immediately enters 'CrashLoopBackOff'. 'kubectl describe pod test-pod' shows 'Back-off restarting failed container'. Which admission controller might cause this if misconfigured?

Accepted Answer

MutatingAdmissionWebhook. A MutatingAdmissionWebhook can modify Pod specifications (e.g., injecting sidecar containers, changing image names, or adding init containers) before the Pod is persisted. If the webhook misconfigures the Pod—such as replacing the image with a non-existent one or adding a failing init container—the container may fail to start, causing a CrashLoopBackOff. The 'Back-off restarting failed container' message indicates the container itself is failing, which aligns with a mutation that breaks the Pod's runtime behavior.

Answer

ValidatingAdmissionWebhook

Answer

PodSecurity

Answer

PersistentVolumeClaimResize

Question 8

A security scan report shows that a container image has several high-severity CVEs. The team wants to implement automated scanning in CI/CD pipeline. Which tool would you recommend for scanning container images in a CI pipeline?

Accepted Answer

Trivy. Trivy is a comprehensive, open-source vulnerability scanner specifically designed for container images, filesystems, and Git repositories. It integrates seamlessly into CI/CD pipelines, detects high-severity CVEs by cross-referencing image layers against multiple vulnerability databases (e.g., NVD, Red Hat, Alpine), and provides actionable remediation advice. This makes it the correct choice for automated scanning of container images in a CI pipeline.

Answer

Syft

Answer

Checkov

Answer

Kubesec

Question 9

An organization uses Kyverno to enforce policies. Which Kyverno rule action would you use to require that all images come from a specific registry?

Accepted Answer

validate. The `validate` action in Kyverno is used to enforce policies that check resource attributes against specified rules. To require that all images come from a specific registry, you would use a `validate` rule with a pattern or deny clause that inspects the image field (e.g., `spec.containers[*].image`) and rejects any that do not match the allowed registry prefix. This ensures non-compliant resources are blocked at admission time.

Answer

verifyImages

Answer

generate

Answer

mutate

Question 10

A user creates a Deployment with image 'alpine:3.18' and the Pod status is 'ErrImagePull'. The admin checks the image policy and sees that only images with SHA digests are allowed. What is the fix?

Accepted Answer

Change the image to 'alpine@sha256:...'. The cluster policy requires images to be identified by SHA digest rather than tags. Using an image reference like 'alpine@sha256:...' ensures the image is pulled by its immutable digest, bypassing tag-based resolution and satisfying the policy. This is a common supply chain security measure to prevent tag mutability and ensure image integrity.

Answer

Enable the AlwaysPullImages admission controller

Answer

Change the image to 'alpine:latest'

Answer

Add a non-root user to the Dockerfile

Question 11

Which command would scan a Kubernetes Pod manifest for security issues?

Accepted Answer

checkov -f pod.yaml. Both A and D are correct because `checkov -f pod.yaml` and `kubesec scan pod.yaml` are static analysis tools that scan Kubernetes YAML manifests for security misconfigurations such as privileged containers, hostNetwork access, and violations of Pod Security Standards. Checkov is a general IaC scanner supporting Kubernetes, while kubesec is specialized for Kubernetes resources. Options B and C are incorrect: `trivy image` scans container images for vulnerabilities, not manifest files, and `cosign verify` verifies container image signatures. Thus, A and D are valid commands for scanning a Pod manifest.

Answer

trivy image pod.yaml

Answer

cosign verify pod.yaml

Question 12

An administrator wants to enforce that all pods run with read-only root filesystem. Which admission controller can achieve this without writing custom code?

Accepted Answer

PodSecurity. The PodSecurity admission controller enforces the Pod Security Standards (PSS), which include a policy to restrict pods to a read-only root filesystem. Specifically, the 'Restricted' profile sets `readOnlyRootFilesystem: true` as a required field, preventing pods from writing to their root filesystem without custom code.

Answer

ServiceAccount

Answer

MutatingAdmissionWebhook

Answer

ImagePolicyWebhook

Question 13

Which TWO are best practices for Dockerfile security? (Select 2)

Accepted Answer

Use a non-root user. Running containers as a non-root user reduces the risk of privilege escalation attacks. If an attacker compromises the container, they will not have root privileges, limiting their ability to modify system files or escape the container. This is enforced by using the USER directive in the Dockerfile to specify a non-root UID (e.g., USER 1001).

Answer

Store secrets in environment variables

Answer

Install SSH server for debugging

Answer

Run the container as root

Question 14

Which THREE are valid methods to verify the integrity and origin of a container image? (Select 3)

Accepted Answer

Notary. Notary is correct because it is a tool that enables the signing and verification of container images using The Update Framework (TUF), ensuring both integrity (the image has not been tampered with) and origin (the image was signed by a trusted publisher). It works by managing cryptographic signatures and metadata in a trusted collection, allowing clients to verify the signature chain before pulling an image.

Answer

Trivy fs

Answer

Syft

Question 15

Which TWO are tools for static analysis of Kubernetes manifests? (Select 2)

Accepted Answer

Kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes manifests against a set of security best practices. It scans YAML or JSON files for misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments, and assigns a risk score based on the findings.

Answer

Cosign

Answer

Trivy

Answer

Clair