CKS Supply Chain Security Practice Question
An administrator wants to ensure that only signed container images are deployed in the cluster. Which admission controller can be used to enforce this policy?
⚠ Common exam trap
The exam often tests the distinction between admission controllers that enforce image pull behavior (AlwaysPullImages) versus those that enforce image content validation (ImagePolicyWebhook), leading candidates to confuse pull policies with signature verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ImagePolicyWebhook
The ImagePolicyWebhook admission controller allows a cluster to enforce a policy that only signed container images are deployed by intercepting image creation requests and validating them against an external webhook. This webhook can check image signatures (e.g., using Notary or Cosign) before admitting the pod, making it the correct choice for enforcing signed image policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ServiceAccount
Why it's wrong here
ServiceAccount governs pod identity and API credentials, not image signature verification, so it cannot enforce signed images. It is tempting because admission controllers intercept pod creation, but signature enforcement requires a policy engine such as Kyverno or Gatekeeper, or the ImagePolicyWebhook admission controller.
- ✗
AlwaysPullImages
Why it's wrong here
AlwaysPullImages forces every pod to re-pull its image at start, which verifies registry availability but never checks a signature. It is tempting because it is a built-in admission controller touching image handling, and it would be correct when the requirement is preventing stale cached images from being reused.
- ✓
ImagePolicyWebhook
Why this is correct
ImagePolicyWebhook is a built-in Kubernetes admission controller that forwards pod creation requests to an external HTTPS endpoint for image policy evaluation. That webhook can verify signatures against a trusted key, rejecting unsigned images before they are admitted to the cluster.
- ✗
NodeRestriction
Why it's wrong here
NodeRestriction only limits which fields a kubelet may modify on its own Node object; it never inspects image signatures. It is tempting because it is a built-in admission controller that constrains node behaviour, and it would be the right choice when hardening against a compromised kubelet altering node metadata.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Policy Enforcement and Admission Controllers
Key term
Node Restriction
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.