CKS Supply Chain Security Practice Question
A security team is implementing supply chain security for their Kubernetes cluster. They want to ensure that only container images that have been signed and verified are deployed. They are evaluating admission controllers and tools. Which TWO of the following are valid approaches to enforce image signature verification at admission time? (Choose two.)
⚠ Common exam trap
The trap here is assuming that pod security or image pull policies can enforce signature verification, but they operate at different layers and do not validate cryptographic signatures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the ImagePolicyWebhook admission controller with a custom webhook that calls cosign verify.
Enforcing image signature verification at admission time can be achieved through the ImagePolicyWebhook admission controller with a custom webhook that calls cosign verify, or through a Kyverno policy that uses the verifyImages rule. Both approaches intercept pod creation and validate image signatures before allowing the pod. The other options do not provide signature verification capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the PodSecurity admission controller with the restricted profile to enforce image signing.
Why it's wrong here
The PodSecurity admission controller enforces Pod Security Standards, which focus on pod-level security contexts, such as running as non-root, restricting capabilities, and seccomp profiles. It does not have the capability to verify image signatures or enforce image provenance. Therefore, it cannot be used for image signature verification.
- ✗
Use the NodeRestriction admission controller to restrict which images can be pulled by kubelets.
Why it's wrong here
The NodeRestriction admission controller limits the permissions of the kubelet and Node API objects, ensuring that nodes can only modify their own resources. It does not inspect or verify container image signatures. Its purpose is to restrict node-level actions, not to enforce image policies. Thus, it is not suitable for signature verification.
- ✗
Use the AlwaysPullImages admission controller to ensure images are always pulled and verified by the container runtime.
Why it's wrong here
The AlwaysPullImages admission controller modifies pods to set imagePullPolicy to Always, ensuring that images are pulled from the registry each time a pod is created. While this can help with freshness, it does not verify signatures. The container runtime does not perform signature verification unless configured with a policy, and this admission controller does not add such verification.
- ✓
Use the ImagePolicyWebhook admission controller with a custom webhook that calls cosign verify.
Why this is correct
The ImagePolicyWebhook admission controller allows an external webhook to make admission decisions based on image policies. By implementing a webhook that uses cosign verify to check signatures, the cluster can enforce that only signed images are admitted. This is a valid and flexible approach, though it requires deploying and maintaining the webhook service.
- ✓
Use a Kyverno policy that verifies image signatures using the verifyImages rule.
Why this is correct
Kyverno is a Kubernetes-native policy engine that can validate, mutate, and generate configurations. Its verifyImages rule can verify Cosign signatures on container images as part of admission control. This allows enforcing signature verification without writing a custom webhook. Kyverno integrates directly with the Kubernetes API server as a dynamic admission controller.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Secrets Management and Encryption
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
Key term
Admission Controllers
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.