CKS Supply Chain Security Practice Question
A DevOps engineer wants to enforce that all container images running in the cluster are signed using Cosign. Which Kubernetes admission controller is designed for this purpose?
⚠ Common exam trap
Candidates often confuse the generic ValidatingAdmissionWebhook (a Kubernetes admission controller) with the dedicated ImagePolicyWebhook, which is the specific admission controller designed for image policy enforcement in Kubernetes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ImagePolicyWebhook
The ImagePolicyWebhook admission controller is specifically designed to enforce that container images meet certain criteria, such as being signed with Cosign, by querying an external webhook service that validates image signatures before admitting a pod. It intercepts pod creation requests and checks the image references against a configured policy, making it the correct choice for this Cosign-based image signing enforcement scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MutatingAdmissionWebhook
Why it's wrong here
A MutatingAdmissionWebhook is invoked during admission to modify the incoming resource object—for example, injecting sidecar containers or setting default tolerations—before it is stored. While it could theoretically call an external image-signing service, its intended purpose is mutation, not policy decision-making. Kubernetes does not provide a built-in image-signature check through this controller; that functionality is specifically delegated to ImagePolicyWebhook.
- ✓
ImagePolicyWebhook
Why this is correct
The ImagePolicyWebhook is an admission controller that contacts an external webhook service to evaluate every Pod's image references at creation time. The external service can verify signatures, digest pins, or other supply-chain criteria, returning an allow/deny decision (and optionally an image rewrite). This is the built-in, dedicated mechanism for enforcing image signing and provenance policies, distinct from generic webhooks.
- ✗
PodSecurityPolicy (deprecated)
Why it's wrong here
PodSecurityPolicy, before its removal in v1.25, enforced constraints like privileged containers, host namespaces, and volume types based on the user or group running the Pod. It had no awareness of image content, signatures, or registry provenance, so it could never verify that an image was signed. With PSP deprecated and gone, Pod Security Admission (PSA) took over the same role, and neither path involves image signature validation.
- ✗
ValidatingAdmissionWebhook
Why it's wrong here
A ValidatingAdmissionWebhook provides general-purpose admission validation; you could implement custom logic that fetches and checks an image signature using an external service, but that logic must be developed, hosted, and maintained by you. It is not designed specifically for image policy, and unlike ImagePolicyWebhook, it does not have a well-defined contract for returning replacement image references. Kubernetes therefore recommends ImagePolicyWebhook as the native, out-of-the-box solution for image signing verification.
Go deeper
Related to this question
Learn chapter
Kubernetes Security Fundamentals
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
Key term
Node Restriction
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.