CKS Supply Chain Security Practice Question
A DevOps engineer wants to ensure that a container image is signed and the signature is verified before deployment. Which Cosign command verifies an image signature?
⚠ Common exam trap
Candidates often confuse `cosign verify` with `cosign attest`, as both deal with image integrity, but `attest` creates metadata while `verify` checks the actual signature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cosign verify
The `cosign verify` command is used to check the signature of a container image against the public key that was used to sign it. This ensures the image's integrity and authenticity before deployment, which is a core requirement of the CKS Supply Chain Security domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
cosign sign
Why it's wrong here
cosign sign is used to generate a signature for a container image, typically by creating a digital signature stored alongside the image in an OCI registry. It does not perform any validation or verification of the image's authenticity; it is the act of producing a signature. Therefore, while it may create artifacts that enable later verification, it cannot be used to ensure an image is safe.
- ✗
cosign check
Why it's wrong here
The command 'cosign check' does not exist in the Cosign CLI. The available signature-related subcommands are sign, verify, attest, and verify-attestation, among others. Using a non-existent command will simply fail with an error, so it cannot satisfy the engineer's goal of confirming an image's signature.
- ✓
cosign verify
Why this is correct
cosign verify is the correct command because it verifies the digital signature of a container image against a trusted public key. It checks that the signature is valid for the image's digest and that the image has not been tampered with. If the signature is missing or invalid, the command fails, thereby confirming the image's authenticity and integrity.
- ✗
cosign attest
Why it's wrong here
cosign attest is used to generate and attach an in-toto attestation to a container image, which is a signed statement about the image's build process, provenance, or other metadata. It does not verify an existing signature; instead, it creates a new attestation that can later be verified using the 'verify-attestation' command. Thus, it is not a command for checking the validity of an image.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Container Image Security
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.