CKS Supply Chain Security Practice Question
A security engineer needs to verify that a container image stored in a private OCI registry has not been tampered with before allowing it to run in a production cluster. The image was signed using Cosign with a key pair. The engineer has the public key. Which command should the engineer use to verify the signature?
⚠ Common exam trap
Many candidates confuse cosign verify with cosign verify-blob, which is meant for verifying signatures on arbitrary blobs rather than container images in a registry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cosign verify --key cosign.pub registry.example.com/app:1.0
To verify a Cosign signature on a container image, the cosign verify command is used with the public key and the image reference. This checks the signature against the image digest. The other options either use the wrong subcommand, an invalid flag, or an unnecessary insecure flag that does not contribute to signature verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
cosign verify --key cosign.pub --registry-token $(cat token) registry.example.com/app:1.0
Why it's wrong here
While this command attempts to verify the image with an additional registry token flag, the --registry-token flag is not a valid option for the cosign verify command. Cosign uses standard registry authentication mechanisms, such as Docker credentials, rather than a custom token flag. Thus, this command would fail due to an unrecognized flag.
- ✗
cosign verify --key cosign.pub --insecure registry.example.com/app:1.0
Why it's wrong here
The --insecure flag allows connecting to a registry over HTTP instead of HTTPS. However, in this scenario, the registry is private but not necessarily insecure; using --insecure would bypass TLS verification and could expose the verification process to man-in-the-middle attacks. The flag does not affect the verification of the signature itself and is not needed if the registry uses HTTPS.
- ✗
cosign verify-blob --key cosign.pub registry.example.com/app:1.0
Why it's wrong here
The verify-blob subcommand is used to verify a signature on a blob (a file or artifact) rather than a container image in a registry. It expects a local file path or a blob reference, not an image reference. Therefore, it is not suitable for verifying a container image signature stored in an OCI registry.
- ✓
cosign verify --key cosign.pub registry.example.com/app:1.0
Why this is correct
This command uses Cosign to verify the signature of the specified image against the provided public key. It checks that the image was signed with the corresponding private key and that the signature is valid, ensuring integrity and authenticity. This is the correct approach for verifying a Cosign signature when the public key is available.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Container Image Security
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.