CKS Supply Chain Security Practice Question
A security engineer wants to ensure that only images signed with a specific key are allowed to run in the cluster. Which tool can be used to sign container images?
⚠ Common exam trap
CNCF often tests the distinction between image scanning (Trivy, Syft) and image signing (Cosign), so candidates mistakenly choose a vulnerability scanner or SBOM tool when the question explicitly asks for signing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
cosign
Cosign is the correct tool because it is specifically designed for signing and verifying container images using cryptographic keys, integrating directly with OCI-compliant registries. It supports keyless signing via Fulcio and transparency logs via Rekor, making it the standard choice for enforcing image signature verification in Kubernetes admission controllers like Kyverno or OPA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubesec
Why it's wrong here
kubesec is a static manifest analyzer that scores Kubernetes YAML against security best practices (e.g., checking for privileged containers, hostNetwork, or writable root filesystems). It does not interact with container image registries at all, so it cannot verify an image's cryptographic signature or provenance. Its output is a risk score, not a trust decision.
- ✗
syft
Why it's wrong here
syft is a tool for generating Software Bills of Materials (SBOMs) from container images or filesystems by enumerating packages and their versions. It has no signature creation or verification capability, and it does not connect to a registry's signature store. Identifying the inventory of an image is fundamentally different from proving that the image was signed by an authorized publisher.
- ✓
cosign
Why this is correct
cosign is part of the Sigstore project and natively supports signing container images and verifying those signatures, including keyless signing via Fulcio and transparency logs (Rekor). It stores signatures as separate OCI artifacts, typically tagged like 'sha256-<digest>.sig', and can enforce that only verified images are admitted. Because it directly addresses the requirement to ensure images are signed, it is the only correct choice here.
- ✗
trivy
Why it's wrong here
trivy is a vulnerability scanner that checks container images and filesystems for known CVEs and misconfigurations, often used in CI/CD pipelines. It intentionally has no signing capability; signature verification is out of its scope. While a signed image can still be vulnerable, trivy's purpose is security defect detection, not provenance or authenticity assurance.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Policy Enforcement and Admission Controllers
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
Key term
Admission Controllers
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.