CKS Supply Chain Security Practice Question
A pod is running in a namespace that has a Kyverno policy requiring all images to come from a trusted registry. The pod is using an image from an untrusted registry. What will happen when the pod is created?
⚠ Common exam trap
It's easy for candidates to confuse admission control with post-creation enforcement (like OPA Gatekeeper's audit mode or Kubernetes security contexts), assuming the pod is created and then terminated, rather than understanding that Kyverno policies block creation at the admission webhook stage before the pod is ever persisted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pod creation will be rejected with an admission error
Kyverno operates as an admission controller in Kubernetes. When a pod is created, the Kyverno admission webhook intercepts the creation request and evaluates it against the configured policies. If the policy requires all images to come from a trusted registry and the pod uses an image from an untrusted registry, the admission webhook rejects the request, preventing the pod from being created. This results in an admission error, not a post-creation termination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pod will be created but immediately terminated
Why it's wrong here
Kyverno operates as an admission webhook that intercepts the pod creation request before the pod is ever persisted in etcd or scheduled to a node. A policy violation results in the request being denied outright, not in the pod being created and then terminated at runtime. The pod never exists, so no immediate termination occurs.
- ✓
The pod creation will be rejected with an admission error
Why this is correct
Kyverno acts as a validating admission controller that evaluates the pod manifest against the configured policy. If a rule is violated, the API server receives a denial response and reports an admission error to the client, preventing the pod from being created. The request is rejected pre-persist, so the pod never runs.
- ✗
The pod will be created and run successfully
Why it's wrong here
If Kyverno is enforcing a policy that validates the pod's image or other attributes, the admission webhook will reject the request before the pod is written to the cluster. A successful creation would only occur if the pod satisfied every policy rule; since the policy is violated, the pod cannot be created and therefore cannot run successfully.
- ✗
The pod will be created but the image will be replaced with a trusted one
Why it's wrong here
Kyverno can either validate or mutate resources, but a policy that 'rejects' is a validating policy, which denies the request entirely. To replace the image with a trusted one, a mutating policy would be needed, and even then the mutation would be applied during admission—not after creation. Since the policy is a denial, no image substitution happens; the request is simply refused.
Go deeper
Related to this question
Learn chapter
Kubernetes Security Fundamentals
Key term
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
Key term
Node Restriction
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.