CKS Supply Chain Security Practice Question
A security admin runs 'trivy image --severity CRITICAL,HIGH myrepo/myapp:latest' and sees many CVEs. The admin wants to ensure that only images with no CRITICAL or HIGH severity vulnerabilities are deployed to the cluster. Which admission controller should be configured to enforce this policy?
⚠ Common exam trap
The CKS exam often tests the distinction between generic admission webhooks (ValidatingAdmissionWebhook, MutatingAdmissionWebhook) and the purpose-built ImagePolicyWebhook, leading candidates to choose a generic webhook when the question explicitly asks for the controller designed for image policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ImagePolicyWebhook
The ImagePolicyWebhook admission controller is specifically designed to evaluate container images against an external policy backend before they are admitted into the cluster. By configuring it to reject images with CRITICAL or HIGH severity vulnerabilities (as reported by Trivy), the admin can enforce that only compliant images are deployed. This controller intercepts Pod creation requests and queries an external webhook to decide whether to allow or deny the image based on the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PodSecurityPolicy
Why it's wrong here
PodSecurityPolicy enforces pod-level security contexts such as privileged, hostNetwork, or hostPID flags, but it has no mechanism to inspect container image metadata, query vulnerability databases, or act on CVE severity. It was deprecated in Kubernetes v1.21 and removed in v1.25, and its successor, Pod Security Admission, also does not perform image scanning. Therefore, even with Trivy output indicating critical or high risk, PodSecurityPolicy could never block a Pod based on those findings.
- ✗
ValidatingAdmissionWebhook
Why it's wrong here
ValidatingAdmissionWebhook is a generic admission controller that accepts an AdmissionReview and can reject a request after arbitrary validation, so in theory it could call an image scanner. However, it is not specialized for image policy; the operator must manually implement image reference extraction, backend communication, timeout handling, and fail-open/fail-closed logic. Kubernetes provides ImagePolicyWebhook specifically for this use case, which is a built-in admission controller that already handles these concerns and is the intended solution for image admission decisions.
- ✗
MutatingAdmissionWebhook
Why it's wrong here
MutatingAdmissionWebhook is designed to modify AdmissionReview objects before they are stored, such as injecting sidecars, setting default resource limits, or applying labels. It does not produce an allow/deny verdict, which is what image security enforcement requires; it also cannot act on external vulnerability scan results because its contract is about mutation, not policy evaluation. If used to rewrite image tags to 'safe' ones, it would silently change behavior and still bypass the vulnerability policy rather than enforcing it.
- ✓
ImagePolicyWebhook
Why this is correct
ImagePolicyWebhook is the Kubernetes-native admission controller that delegates image policy decisions to an external backend service. When a Pod is created, it sends an ImagePolicyReview containing the container image references to a configured HTTPS backend, which returns an allow or deny response based on the organization's policy—such as rejecting images that Trivy flagged as critical or high. This is the correct mechanism to integrate image vulnerability scanning into the admission path, and it is the only option listed that is purpose-built for this exact scenario.
Go deeper
Related to this question
Learn chapter
Kubernetes Security Fundamentals
Key term
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
Key term
Node Restriction
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.