CKS Supply Chain Security Practice Test 8 — 15 Questions

Question 1

A security admin wants to ensure that all container images in a Kubernetes cluster are scanned for known vulnerabilities before being deployed. Which tool can be integrated into a CI/CD pipeline to scan container images for CVEs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner for container images, filesystems, and Git repositories. It can be integrated into CI/CD pipelines to automatically scan container images for known CVEs before deployment, making it the correct choice for this requirement.

Answer

kubesec

Answer

Helm

Answer

kubectl

Question 2

An administrator wants to ensure that only signed container images are deployed in the cluster. Which admission controller can be used to enforce this policy?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows a cluster to enforce a policy that only signed container images are deployed by intercepting image creation requests and validating them against an external webhook. This webhook can check image signatures (e.g., using Notary or Cosign) before admitting the pod, making it the correct choice for enforcing signed image policies.

Answer

ServiceAccount

Answer

AlwaysPullImages

Answer

NodeRestriction

Question 3

Which command is used to sign a container image with Cosign?

Accepted Answer

cosign sign. The `cosign sign` command is used to sign container images and other artifacts, creating a digital signature that is stored alongside the image in the registry. This signature can later be verified with `cosign verify` to ensure the image's integrity and origin. The other options serve different purposes: `cosign attest` attaches an in-toto attestation, `cosign generate` creates key pairs, and `cosign verify` checks signatures.

Answer

cosign attest

Answer

cosign generate

Answer

cosign verify

Question 4

You have a Kyverno policy that validates image registries. The policy should allow only images from `myregistry.example.com`. Which Kyverno rule field should be used to check the image registry?

Accepted Answer

imageRegistry. The `imageRegistry` field in a Kyverno policy rule is specifically designed to validate image registries by matching the registry hostname against a pattern. In this case, setting `imageRegistry: "myregistry.example.com/*"` ensures only images from that registry are allowed, blocking others at admission time.

Answer

mutate

Answer

resources

Answer

generate

Question 5

An administrator runs `kubectl run nginx --image=nginx:latest` and the pod remains in ImagePullBackoff. The cluster uses containerd as the container runtime. What is the most likely cause?

Accepted Answer

The container runtime is not configured correctly. ImagePullBackoff indicates that the kubelet failed to pull the container image. For a public image like nginx:latest, no Docker Hub authentication is required for a standard pull. The failure is best attributed to a misconfiguration of the containerd runtime, such as an invalid registry mirror, missing/incorrect containerd plugin configuration, or network restrictions that prevent the node from reaching Docker Hub. Option B correctly identifies that the container runtime is not configured correctly.

Answer

The image tag 'latest' is not recommended

Answer

The image name is misspelled

Answer

The cluster does not have authentication to pull from Docker Hub

Question 6

Which of the following is a best practice for Dockerfiles to improve supply chain security?

Accepted Answer

Use a distroless base image. Distroless base images contain only the application and its runtime dependencies, significantly reducing the attack surface by eliminating package managers, shells, and other utilities that could be exploited. This aligns with the principle of minimalism in supply chain security, as fewer components mean fewer potential vulnerabilities and a smaller blast radius in case of compromise.

Answer

Use the latest tag for base images to get the newest features

Answer

Run the container as root by default

Answer

Hardcode secrets directly in the Dockerfile

Question 7

A DevOps team wants to enforce that all Deployments must have a specific label 'app.kubernetes.io/name'. Which tool can be used to validate this in the admission controller stage?

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that can validate, mutate, and generate resources using admission webhooks. It can enforce that all Deployments carry the label 'app.kubernetes.io/name' by defining a 'validate' rule in a ClusterPolicy, which checks the resource during the admission controller stage before it is persisted to etcd.

Answer

Trivy

Answer

Cosign

Answer

Syft

Question 8

What does SBOM stand for in the context of supply chain security?

Accepted Answer

Software Bill of Materials. SBOM stands for Software Bill of Materials. It is a formal, machine-readable inventory of all components, libraries, and dependencies used to build a software artifact. In supply chain security, an SBOM enables organizations to quickly identify and remediate vulnerabilities (e.g., Log4Shell) by tracking which versions of open-source or third-party components are included in a release.

Answer

Systematic Bug and Oversight Manager

Answer

Secure Build Orchestration Manager

Answer

Source Binary Object Model

Question 9

An admin wants to scan a local filesystem for vulnerabilities using Trivy. Which command should they use?

Accepted Answer

trivy fs. `trivy fs` scans a local filesystem for vulnerabilities, misconfigurations, and secrets. This command is specifically designed to analyze directories and files on disk, making it the appropriate choice for scanning a local filesystem as described in the question.

Answer

trivy image

Answer

trivy config

Answer

trivy repo

Question 10

Which tool can generate an SBOM for a container image?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) for container images and filesystems. It scans the image layers and package managers (e.g., APT, RPM, pip, npm) to produce an SBOM in formats like CycloneDX or SPDX, directly addressing the question's requirement.

Answer

Trivy

Answer

Cosign

Answer

Kubescape

Question 11

A cluster has the ImagePolicyWebhook admission controller enabled. A pod creation is denied with the message 'image policy check failed'. The webhook server returns an error. Which of the following could be a valid reason?

Accepted Answer

The image is not signed by a trusted authority. The ImagePolicyWebhook admission controller intercepts pod creation requests and queries an external webhook server to determine whether the image should be allowed. If the webhook returns an error (e.g., HTTP 5xx or a denial response), the admission controller fails the request with 'image policy check failed'. A common reason for the webhook to deny the request is that the image is not signed by a trusted authority, as the webhook may be configured to enforce image signature verification (e.g., using Notary or Sigstore).

Answer

The container runtime is out of date

Answer

The image tag does not exist in the registry

Answer

The pod specification has a hostNetwork: true

Question 12

Which Kubernetes admission controller ensures that a pod only uses images from a specific registry?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows you to define a webhook that validates container images against a policy, such as restricting them to a specific registry. When a pod is created, Kubernetes sends an admission review to the webhook, which can reject images not from the allowed registry. This is the correct choice because it directly enforces image source policies.

Answer

NamespaceLifecycle

Answer

PodNodeSelector

Answer

AlwaysPullImages

Question 13

Which TWO of the following are best practices for securing the container supply chain? (Select 2)

Accepted Answer

Scan container images for vulnerabilities. Using minimal base images reduces the attack surface, and scanning images for vulnerabilities helps identify and fix security issues before deployment.

Answer

Disable image pull secrets to reduce complexity

Answer

Hardcode secrets in the Dockerfile for convenience

Answer

Run containers as root to simplify permissions

Question 14

Which THREE of the following can be used to enforce policies on container images in a Kubernetes cluster? (Select 3)

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that can enforce policies on container images, such as requiring specific image registries, disallowing the latest tag, or mandating image signatures. It operates as a dynamic admission controller using ValidatingAdmissionPolicy or MutatingAdmissionPolicy resources, making it a correct choice for image policy enforcement.

Answer

Trivy

Answer

kubectl

Question 15

Which TWO of the following are valid methods to verify the integrity of a container image? (Select 2)

Accepted Answer

Compare the image SHA digest with a known good digest. Container images are identified by a content-addressable digest (SHA256 hash) that uniquely represents the image manifest. Verifying that the SHA digest of a pulled image matches a known good digest from a trusted source ensures the image has not been tampered with or altered in transit, as any change to the image layers or configuration would result in a different digest.

Answer

Use trivy image to check for vulnerabilities

Answer

Use docker history to view layers

Answer

Use kubectl describe pod to check image details