CKS Supply Chain Security Practice Question
A developer wants to ensure that a pod always uses a specific version of an image that cannot be changed without updating the manifest. Which image reference should be used?
⚠ Common exam trap
A common misconception is that semantic version tags (e.g., 'v1.0' or '1.0.0') are immutable, but in reality, tags are mutable pointers that can be reassigned, whereas only digest references provide true immutability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
myimage@sha256:abcdef...
(myimage@sha256:abcdef...) uses a digest-based image reference, which pins the image to an immutable content hash. This ensures that the exact same image is always pulled, regardless of tag updates, and any change to the image would require updating the manifest. This aligns with the requirement that the image version cannot be changed without modifying the manifest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
myimage@sha256:abcdef...
Why this is correct
A digest reference pins the pod to the exact image content by its sha256 hash. Unlike a mutable tag, the digest cannot be repointed, so the running image stays identical unless the manifest is edited to a new digest.
- ✗
myimage:latest
Why it's wrong here
The latest tag is mutable and is reassigned on every push, so the pod would pull whatever content currently carries that tag without any manifest change. It is intended as a convenience default for local development; it would be acceptable only where the registry enforces tag immutability or the deployment is disposable.
- ✗
myimage:v1.0
Why it's wrong here
Tags can be overwritten, so v1.0 could point to a different image later.
- ✗
myimage:1.0.0
Why it's wrong here
A mutable tag such as 1.0.0 can be re-pushed to the registry, so the digest changes while the manifest stays untouched; only a digest reference (myimage@sha256:...) pins the immutable content. Tags are intended for human-readable versioning, and 1.0.0 would suffice if the registry enforced tag immutability.
Go deeper
Related to this question
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.