20+ practice questions focused on Supply Chain Security — one of the most tested topics on the Certified Kubernetes Security Specialist CKS exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Supply Chain Security PracticeWhich THREE of the following are required to implement a secure software supply chain using Kubernetes native features?
Explanation: Vulnerability scanning tools like Trivy or Grype are essential for identifying known CVEs in container images before deployment. Integrating these tools into the CI/CD pipeline ensures that only images with an acceptable vulnerability posture are built and pushed to the registry, forming a foundational security gate in the software supply chain.
You are securing a Kubernetes cluster that runs workloads from multiple teams. The cluster uses a private container registry and an admission controller to enforce image policies. Which TWO of the following actions are most effective in preventing the use of unapproved or tampered container images? (Choose two correct answers.)
Explanation: Kyverno can enforce policies that require images to have a specific annotation, such as one indicating a passed security scan, which helps ensure only images that have been verified by your security pipeline are allowed to run. An ImagePolicyWebhook admission controller can verify image signatures and only allow signed images from your trusted registry, which directly prevents tampered or unsigned images from being deployed. Together, these two controls address both unapproved and tampered images.
You are configuring an ImagePolicyWebhook admission controller to allow only images from a trusted registry 'trusted-registry.io'. Which flag must be set in the kube-apiserver configuration to enable the webhook?
Explanation: The ImagePolicyWebhook admission controller requires an external configuration file to specify the webhook server URL, CA bundle, and other settings. The `--admission-control-config-file` flag points to this file, which the kube-apiserver reads to enable and configure the webhook for image policy validation.
A cluster uses ImagePolicyWebhook admission controller. After configuring it, deployments referencing images from an unauthorized registry are blocked. However, some deployments are still being admitted. What is a possible cause?
Explanation: The ImagePolicyWebhook admission controller must be placed before mutating admission webhooks in the admission chain. If it is placed after mutating webhooks, a mutating webhook could modify the image reference (e.g., rewriting the registry URL) after the ImagePolicyWebhook has already validated it, effectively bypassing the policy. The order of admission controllers in the kube-apiserver's `--enable-admission-plugins` flag matters, and the ImagePolicyWebhook should be early in the chain to enforce policy before any mutations occur.
Which tool can be used to generate an SBOM (Software Bill of Materials) for a container image?
Explanation: Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to catalog packages (e.g., APK, DEB, RPM, Python, Java) and outputs the SBOM in formats like SPDX or CycloneDX, which are industry standards for supply chain transparency. This makes it the correct choice for generating an SBOM from a container image in a CKS context.
+15 more Supply Chain Security questions available
Practice all Supply Chain Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Supply Chain Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Supply Chain Security questions on the CKS frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Supply Chain Security is tested as part of the Certified Kubernetes Security Specialist CKS blueprint. Practicing with targeted Supply Chain Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CKS practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Supply Chain Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Supply Chain Security practice session with instant scoring and detailed explanations.
Start Supply Chain Security Practice →