CKS Supply Chain Security Practice Test 9 — 15 Questions

Question 1

A security admin wants to ensure that all container images in a Kubernetes cluster are scanned for known vulnerabilities before being deployed. Which tool can be integrated into a CI/CD pipeline to scan container images for CVEs?

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner for container images, filesystems, and Git repositories. It can be integrated into CI/CD pipelines to scan images before deployment.

Answer

kubesec

Answer

Helm

Answer

kubectl

Question 2

An administrator wants to ensure that only signed container images are deployed in the cluster. Which admission controller can be used to enforce this policy?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows external webhooks to validate image signatures before accepting a pod. It can be configured to reject unsigned images.

Answer

ServiceAccount

Answer

AlwaysPullImages

Answer

NodeRestriction

Question 3

Which command is used to sign a container image with Cosign?

Accepted Answer

cosign sign. The `cosign sign` command is used to sign a container image and attach the signature to the image registry.

Answer

cosign attest

Answer

cosign generate

Answer

cosign verify

Question 4

You have a Kyverno policy that validates image registries. The policy should allow only images from `myregistry.example.com`. Which Kyverno rule field should be used to check the image registry?

Accepted Answer

imageRegistry. The `imageRegistry` field in Kyverno allows you to specify a regular expression to match allowed image registries.

Answer

mutate

Answer

resources

Answer

generate

Question 5

An administrator runs `kubectl run nginx --image=nginx:latest` and the pod remains in ImagePullBackoff. The cluster uses containerd as the container runtime. What is the most likely cause?

Accepted Answer

The cluster does not have authentication to pull from Docker Hub. `ImagePullBackoff` indicates that the kubelet is unable to pull the image. Using `latest` tag can lead to pull failures if the tag is not found or if there is a registry issue, but more commonly, it's due to authentication or network issues. However, the most likely cause among the options is that the image requires authentication and no image pull secrets are configured.

Answer

The image tag 'latest' is not recommended

Answer

The container runtime is not configured correctly

Answer

The image name is misspelled

Question 6

Which of the following is a best practice for Dockerfiles to improve supply chain security?

Accepted Answer

Use a distroless base image. Using distroless base images reduces the attack surface by minimizing installed packages and dependencies.

Answer

Use the latest tag for base images to get the newest features

Answer

Run the container as root by default

Answer

Hardcode secrets directly in the Dockerfile

Question 7

A DevOps team wants to enforce that all Deployments must have a specific label 'app.kubernetes.io/name'. Which tool can be used to validate this in the admission controller stage?

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that can validate, mutate, and generate resources using admission controller webhooks. It can enforce that certain labels exist on resources.

Answer

Trivy

Answer

Cosign

Answer

Syft

Question 8

What does SBOM stand for in the context of supply chain security?

Accepted Answer

Software Bill of Materials. SBOM is a Software Bill of Materials, a detailed list of components, dependencies, and metadata used in a software artifact.

Answer

Systematic Bug and Oversight Manager

Answer

Secure Build Orchestration Manager

Answer

Source Binary Object Model

Question 9

An admin wants to scan a local filesystem for vulnerabilities using Trivy. Which command should they use?

Accepted Answer

trivy fs. `trivy fs` is the command to scan a filesystem for vulnerabilities, including configuration files and source code.

Answer

trivy image

Answer

trivy config

Answer

trivy repo

Question 10

Which tool can generate an SBOM for a container image?

Accepted Answer

Syft. Syft is a CLI tool that generates Software Bill of Materials (SBOM) from container images and filesystems.

Answer

Trivy

Answer

Cosign

Answer

Kubescape

Question 11

A cluster has the ImagePolicyWebhook admission controller enabled. A pod creation is denied with the message 'image policy check failed'. The webhook server returns an error. Which of the following could be a valid reason?

Accepted Answer

The image is not signed by a trusted authority. The ImagePolicyWebhook can reject images based on external policy. If the image is not signed or the signature cannot be verified, the webhook may deny the request.

Answer

The container runtime is out of date

Answer

The image tag does not exist in the registry

Answer

The pod specification has a hostNetwork: true

Question 12

Which Kubernetes admission controller ensures that a pod only uses images from a specific registry?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller can be configured to allow or deny images based on registry, via an external webhook.

Answer

NamespaceLifecycle

Answer

PodNodeSelector

Answer

AlwaysPullImages

Question 13

Which TWO of the following are best practices for securing the container supply chain? (Select 2)

Accepted Answer

Scan container images for vulnerabilities. Using minimal base images reduces the attack surface, and scanning images for vulnerabilities helps identify and fix security issues before deployment.

Answer

Disable image pull secrets to reduce complexity

Answer

Hardcode secrets in the Dockerfile for convenience

Answer

Run containers as root to simplify permissions

Question 14

Which THREE of the following can be used to enforce policies on container images in a Kubernetes cluster? (Select 3)

Accepted Answer

Kyverno. OPA/Gatekeeper, Kyverno, and ImagePolicyWebhook are all tools that can enforce image policies such as allowed registries, signatures, or other criteria.

Answer

Trivy

Answer

kubectl

Question 15

Which TWO of the following are valid methods to verify the integrity of a container image? (Select 2)

Accepted Answer

Compare the image SHA digest with a known good digest. Cosign verify checks signatures, and comparing SHA digests ensures the image content hasn't changed.

Answer

Use trivy image to check for vulnerabilities

Answer

Use docker history to view layers

Answer

Use kubectl describe pod to check image details