CKS Supply Chain Security Practice Question
A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?
⚠ Common exam trap
A common misconception is that PodSecurityPolicy (PSP) can enforce image-related policies, but PSP is deprecated and handles only security context constraints, not image tags or registries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OPA/Gatekeeper
OPA/Gatekeeper is the correct tool because it allows you to define and enforce custom admission control policies via ConstraintTemplates and Constraints. You can create a policy that rejects any Pod using an image tagged with 'latest' by inspecting the `spec.containers[].image` field at admission time, which is not possible with native Kubernetes resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ResourceQuota
Why it's wrong here
ResourceQuota is a built-in admission controller that enforces aggregate resource limits on a namespace, capping metrics like requests.cpu, requests.memory, limits.cpu, limits.memory, and object counts such as persistentvolumeclaims and pods. Its evaluation logic only inspects the resource request/limit fields of a pod, not the container image reference or tag. Thus, while it can reject a pod for exceeding quota, it has no mechanism to validate or deny based on image tag policies.
- ✗
NetworkPolicy
Why it's wrong here
NetworkPolicy is a Kubernetes resource that governs pod-to-pod communication via selected labels, namespaces, and CIDR blocks, with ingress and egress rules enforced by the CNI plugin in the dataplane, not by the API server. It operates after a pod has been successfully created and runs, filtering network traffic at L3/L4, so it never inspects the pod's image field during admission. Therefore, it cannot reject a pod before creation based on an image tag restriction.
- ✗
PodSecurityPolicy (PSP)
Why it's wrong here
PodSecurityPolicy (PSP) was a cluster-level admission controller that enforced security-sensitive fields such as privileged containers, host namespaces, volumes, and SELinux options. It was deprecated in Kubernetes 1.21 and removed in 1.25, and its policy schema never included a field for specifying allowed image tags or registries, so it could not express a denial of the 'latest' tag. Even when PSP existed, it could only restrict pod security context, not image provenance, making it ineffective for this use case.
- ✓
OPA/Gatekeeper
Why this is correct
OPA/Gatekeeper is a validating admission webhook that integrates with Kubernetes' AdmissionReview API, allowing you to define custom policies as ConstraintTemplates written in Rego. These policies can inspect every field in the Pod spec, including container image references, and either mutate or reject the request at admission time. By writing a Rego rule that denies any image whose tag equals 'latest' (or that lacks an explicit tag), Gatekeeper can automatically reject violating pods before they are persisted, making it the correct tool for this requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.