CKS Supply Chain Security Practice Test 9 — 15 Questions

Question 1

Which TWO of the following tools can be used to generate or analyze SBOMs? (Select 2)

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate Software Bill of Materials (SBOMs) from container images and filesystems. It supports multiple output formats such as CycloneDX and SPDX, making it a direct choice for SBOM generation. Trivy, while primarily a vulnerability scanner, also includes built-in SBOM generation and analysis capabilities, allowing users to output SBOMs in CycloneDX or SPDX formats and to scan existing SBOMs for vulnerabilities.

Answer

Cosign

Answer

Kubesec

Answer

Checkov

Question 2

An administrator wants to ensure that only images from a trusted registry 'myregistry.io' can run in the cluster. Which admission controller should be configured?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller enforces that only images from a trusted registry (e.g., 'myregistry.io') can run. It does this by querying an external webhook to validate the image source against a policy. Options A, B, and D are incorrect: NodeRestriction restricts node API access, MutatingAdmissionWebhook can mutate pods but is not specifically designed for image registry control, and PodSecurity handles pod security contexts, not image source validation.

Answer

NodeRestriction

Answer

MutatingAdmissionWebhook

Answer

PodSecurity

Question 3

Which command is used with Cosign to sign a container image?

Accepted Answer

cosign sign . The `cosign sign ` command is used to sign a container image by attaching a digital signature to the image manifest in the container registry. This signature, typically stored as a separate tag or in an OCI artifact, allows verification of the image's origin and integrity using the corresponding public key.

Answer

cosign verify <image>

Answer

cosign attest <image>

Answer

cosign generate <image>

Question 4

A DevOps engineer runs 'trivy image myapp:latest' and finds a critical CVE in the base image. Which Dockerfile change would BEST address this?

Accepted Answer

Switch to a distroless base image with a SHA digest. Switching to a distroless base image with a SHA digest (e.g., gcr.io/distroless/base@sha256:...) eliminates the vulnerable packages present in the original base image because distroless images contain only the minimal runtime dependencies (e.g., glibc, libssl) and no package manager or shell, drastically reducing the attack surface. Pinning the image by SHA digest ensures immutability and prevents the base image from being silently updated to a version that reintroduces the same or different vulnerabilities, which is critical for supply chain security.

Answer

Use an Alpine base image with the latest tag

Answer

Set USER root in the Dockerfile

Answer

Add a non-root user in the Dockerfile

Question 5

A security policy requires that all container images must have a signed attestation. Which Cosign command would an admin add to the CI pipeline to create this attestation?

Accepted Answer

cosign attest --type custom --predicate . The `cosign attest` command is specifically designed to create an in-toto attestation for a container image, attaching a signed predicate (e.g., a SLSA provenance file) that satisfies the policy requirement for a signed attestation. The `--type custom` flag allows specifying a custom predicate type, and `--predicate ` provides the attestation payload, which is then signed and stored in the image's OCI manifest as an attached attestation.

Answer

cosign verify-attestation <image>

Answer

cosign sign --key

Answer

cosign download attestation <image>

Question 6

Which tool is used to generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses a pluggable cataloger system to extract package metadata (e.g., dpkg, RPM, APK, Python, Java JARs) and outputs the SBOM in formats like CycloneDX or SPDX, which are the standard formats for supply chain transparency.

Answer

Clair

Answer

Kubesec

Answer

Trivy

Question 7

An admin runs 'kubectl run test-pod --image=nginx:latest' and the Pod is created but immediately enters 'CrashLoopBackOff'. 'kubectl describe pod test-pod' shows 'Back-off restarting failed container'. Which admission controller might cause this if misconfigured?

Accepted Answer

MutatingAdmissionWebhook. A MutatingAdmissionWebhook can modify Pod specifications (e.g., injecting sidecar containers, changing image names, or adding init containers) before the Pod is persisted. If the webhook misconfigures the Pod—such as replacing the image with a non-existent one or adding a failing init container—the container may fail to start, causing a CrashLoopBackOff. The 'Back-off restarting failed container' message indicates the container itself is failing, which aligns with a mutation that breaks the Pod's runtime behavior.

Answer

ValidatingAdmissionWebhook

Answer

PodSecurity

Answer

PersistentVolumeClaimResize

Question 8

A security scan report shows that a container image has several high-severity CVEs. The team wants to implement automated scanning in CI/CD pipeline. Which tool would you recommend for scanning container images in a CI pipeline?

Accepted Answer

Trivy. Trivy is a comprehensive, open-source vulnerability scanner specifically designed for container images, filesystems, and Git repositories. It integrates seamlessly into CI/CD pipelines, detects high-severity CVEs by cross-referencing image layers against multiple vulnerability databases (e.g., NVD, Red Hat, Alpine), and provides actionable remediation advice. This makes it the correct choice for automated scanning of container images in a CI pipeline.

Answer

Syft

Answer

Checkov

Answer

Kubesec

Question 9

An organization uses Kyverno to enforce policies. Which Kyverno rule action would you use to require that all images come from a specific registry?

Accepted Answer

validate. The `validate` action in Kyverno is used to enforce policies that check resource attributes against specified rules. To require that all images come from a specific registry, you would use a `validate` rule with a pattern or deny clause that inspects the image field (e.g., `spec.containers[*].image`) and rejects any that do not match the allowed registry prefix. This ensures non-compliant resources are blocked at admission time.

Answer

verifyImages

Answer

generate

Answer

mutate

Question 10

A user creates a Deployment with image 'alpine:3.18' and the Pod status is 'ErrImagePull'. The admin checks the image policy and sees that only images with SHA digests are allowed. What is the fix?

Accepted Answer

Change the image to 'alpine@sha256:...'. The cluster policy requires images to be identified by SHA digest rather than tags. Using an image reference like 'alpine@sha256:...' ensures the image is pulled by its immutable digest, bypassing tag-based resolution and satisfying the policy. This is a common supply chain security measure to prevent tag mutability and ensure image integrity.

Answer

Enable the AlwaysPullImages admission controller

Answer

Change the image to 'alpine:latest'

Answer

Add a non-root user to the Dockerfile

Question 11

Which TWO are best practices for Dockerfile security? (Select 2)

Accepted Answer

Use a non-root user. Running containers as a non-root user reduces the risk of privilege escalation attacks. If an attacker compromises the container, they will not have root privileges, limiting their ability to modify system files or escape the container. This is enforced by using the USER directive in the Dockerfile to specify a non-root UID (e.g., USER 1001).

Answer

Store secrets in environment variables

Answer

Install SSH server for debugging

Answer

Run the container as root

Question 12

Which THREE are valid methods to verify the integrity and origin of a container image? (Select 3)

Accepted Answer

Notary. Notary is correct because it is a tool that enables the signing and verification of container images using The Update Framework (TUF), ensuring both integrity (the image has not been tampered with) and origin (the image was signed by a trusted publisher). It works by managing cryptographic signatures and metadata in a trusted collection, allowing clients to verify the signature chain before pulling an image.

Answer

Trivy fs

Answer

Syft

Question 13

A security admin wants to ensure that all container images in a Kubernetes cluster are scanned for known vulnerabilities before being deployed. Which tool can be integrated into a CI/CD pipeline to scan container images for CVEs?

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner for container images, filesystems, and Git repositories. It can be integrated into CI/CD pipelines to automatically scan container images for known CVEs before deployment, making it the correct choice for this requirement.

Answer

kubesec

Answer

Helm

Answer

kubectl

Question 14

An administrator wants to ensure that only signed container images are deployed in the cluster. Which admission controller can be used to enforce this policy?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows a cluster to enforce a policy that only signed container images are deployed by intercepting image creation requests and validating them against an external webhook. This webhook can check image signatures (e.g., using Notary or Cosign) before admitting the pod, making it the correct choice for enforcing signed image policies.

Answer

ServiceAccount

Answer

AlwaysPullImages

Answer

NodeRestriction

Question 15

Which command is used to sign a container image with Cosign?

Accepted Answer

cosign sign. The `cosign sign` command is used to sign container images and other artifacts, creating a digital signature that is stored alongside the image in the registry. This signature can later be verified with `cosign verify` to ensure the image's integrity and origin. The other options serve different purposes: `cosign attest` attaches an in-toto attestation, `cosign generate` creates key pairs, and `cosign verify` checks signatures.

Answer

cosign attest

Answer

cosign generate

Answer

cosign verify