CKS Supply Chain Security Practice Question
An administrator runs 'kubectl describe pod secure-pod' and sees that the pod is in a Pending state with the event 'Error: ImagePullBackOff' and the message 'unauthorized: authentication required'. The image is stored in a private registry. What is the most likely cause?
⚠ Common exam trap
The CKS exam often tests the distinction between authentication failures (ImagePullBackOff with 'unauthorized') and other pull errors (e.g., DNS, TLS, or image name issues), so candidates must recognize that 'authentication required' points specifically to missing or invalid registry credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Missing imagePullSecret in the pod spec or in the namespace's default service account
The error 'unauthorized: authentication required' indicates that the kubelet cannot authenticate to the private registry. Kubernetes requires an imagePullSecret, which contains registry credentials (typically a Docker config JSON), to be attached either directly to the pod spec or to the namespace's default service account. Without this secret, the kubelet cannot pull the image, resulting in the ImagePullBackOff state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Missing imagePullSecret in the pod spec or in the namespace's default service account
Why this is correct
The 'unauthorized' status in Kubernetes events indicates the image registry rejected the pull because the kubelet did not present valid credentials. Private registries require a kubernetes.io/dockerconfigjson secret referenced in the pod's `imagePullSecrets` field or in the pod's service account. If only the namespace's default service account has the secret and the pod explicitly uses another service account, the secret is not automatically attached, so replication and credential scoping must be checked.
- ✗
The registry requires TLS 1.3 but the kubelet uses TLS 1.2
Why it's wrong here
A TLS version negotiation failure would happen before HTTP authentication and would surface as `tls: handshake failure` or `x509: certificate signed by unknown authority`, not `unauthorized`. The kubelet delegates image pulling to the container runtime, and containerd's TLS stack supports both TLS 1.2 and 1.3, so this cannot be the cause of a 401-style registry authentication response. The registry's authentication challenge occurs over an already-established TLS connection, so the reported error is independent of cipher or protocol version.
- ✗
The image tag is misspelled
Why it's wrong here
A typo in the image tag does not reproduce an authentication error: the registry first checks the requested repository's permissions and only after a successful credential exchange returns the manifest. A missing or mistyped tag would cause the registry to reply with `manifest unknown` or `not found`, leading kubelet to report `ImagePullBackOff` with `ErrImagePull`, never `unauthorized`. This would also be captured in the pod's Events as a different error text, so it is not confused with credential failure.
- ✗
The registry hostname is not resolvable
Why it's wrong here
DNS resolution failure prevents the kubelet from reaching the registry host entirely, so no HTTP request and no `unauthorized` response can be generated. The event message would contain `no such host` or `failed to resolve reference` with the registry name, not an authentication challenge. Kubelet first resolves and connects to the registry; credentials are only exchanged after a TCP/TLS connection and an HTTP request have been successfully completed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.