40 of 190 questions · Page 3/3 · Cks Supply Chain topic · Answers revealed
An administrator wants to verify that an image was signed by a specific key before deploying. Which Cosign command should be used?
This verifies the image signature using the public key.
Why this answer
The 'cosign verify' command checks the signature against a public key and verifies the image.
A DevOps team wants to ensure that only signed images from a trusted registry are deployed in the cluster. They plan to use a webhook to intercept pod creation. Which tool is best suited for this task?
Kyverno supports image signature verification via cosign.
Why this answer
Kyverno is a Kubernetes-native policy engine that can enforce image signature verification via its `verifyImages` rule. It intercepts pod creation through a dynamic admission webhook, checking that container images are signed with a trusted key (e.g., using Sigstore/Cosign) before the pod is admitted. This directly meets the requirement to only allow signed images from a trusted registry.
Exam trap
The trap here is that candidates confuse Helm chart signing (which verifies chart provenance) with container image signing, leading them to select Option B, even though Helm does not verify the images inside the chart at pod creation time.
How to eliminate wrong answers
Option A is wrong because `kubectl --validate` only performs client-side schema validation on the manifest, not image signature verification. Option B is wrong because Helm with signed charts ensures the Helm chart itself is signed, but does not verify the container images referenced within the chart at deployment time. Option C is wrong because etcd encryption at rest protects data stored in etcd (e.g., Secrets) but does not intercept pod creation or verify image signatures.
Option E is wrong because Prometheus with alerting rules monitors metrics and triggers alerts, but cannot enforce admission control or block pod creation based on image signatures.
Which tool is specifically designed to generate a Software Bill of Materials (SBOM) for container images?
Syft is a CLI tool for generating SBOMs from container images and filesystems.
Why this answer
Syft is an open-source tool that generates SBOMs from container images and filesystems.
You are the lead security engineer for a large financial institution. The organization runs a Kubernetes cluster with 500+ microservices. The supply chain security team has implemented the following measures: (1) All images are built from a minimal base image (distroless) and scanned with Trivy before being pushed to a private registry. (2) Images are signed using cosign with a key stored in a hardware security module (HSM). (3) Kyverno policies enforce that only signed images from the private registry can run, and also enforce that containers run as non-root. (4) A binary authorization (binauthz) style admission controller verifies attestations. Recently, a critical vulnerability (CVE-2024-0001) was discovered in a popular open-source library used by several microservices. The library is included as a dependency in the base image. The vulnerability is remotely exploitable and has a CVSS score of 9.8. The security team needs to remediate this quickly. They have already patched the library and updated the base image. What is the BEST course of action to ensure all running pods use the new image?
This ensures all pods are updated with a verified, patched image in a controlled manner.
Why this answer
Option A is correct because updating the image tag in each Deployment triggers a rolling update, which creates new pods with the patched image. The admission controller (Kyverno) will verify the cosign signature and binary authorization attestation for the new image, ensuring supply chain security is maintained. This approach is the standard Kubernetes method for deploying image updates while preserving security controls.
Exam trap
CNCF often tests the misconception that manual intervention (SSH, exec) or disabling security controls is acceptable for urgent fixes, when in fact the correct path is to update the deployment manifest and let Kubernetes orchestrate the change while keeping all security checks active.
How to eliminate wrong answers
Option B is wrong because SSHing into nodes and using kubectl exec to update libraries inside running containers violates the immutable infrastructure principle; changes are ephemeral and lost on pod restart, and this bypasses admission controls, leaving pods unsigned and unverified. Option C is wrong because temporarily disabling the admission controller that verifies signatures creates a window where unsigned or malicious images could be deployed, undermining the entire supply chain security posture. Option D is wrong because deleting pods without updating the image tag causes ReplicaSets to recreate pods from the existing (vulnerable) image, failing to remediate the CVE.
A developer runs 'trivy image myapp:latest' and gets a report with several CRITICAL CVEs. Which action would BEST address the supply chain security risk?
Using a minimal base image reduces the attack surface and eliminates many CVEs.
Why this answer
The best practice is to rebuild the image using a minimal base image with no known vulnerabilities, reducing the attack surface.
An administrator wants to ensure that only signed container images are deployed in the cluster. Which admission controller can be used to enforce this policy?
ImagePolicyWebhook allows an external webhook to validate images, such as verifying Cosign signatures.
Why this answer
The ImagePolicyWebhook admission controller allows external webhooks to validate image signatures before accepting a pod. It can be configured to reject unsigned images.
A CI pipeline fails with the error 'cosign: error: unable to verify image: no matching signatures' when running 'cosign verify --key pubkey.pem myregistry/myapp:latest'. The image was previously signed with a private key. What is the MOST likely cause?
Overwriting a tag with a new, unsigned image removes the previous signature.
Why this answer
If the image tag was overwritten (e.g., pushed again without signing), the old signatures are lost and the new image is unsigned.
Which command is used to sign a container image with Cosign and store the signature in an OCI registry?
Correct command to sign an image.
Why this answer
The 'cosign sign' command signs the image and pushes the signature to the registry.
A security admin wants to ensure that only images signed with a specific key can run in the cluster. Which admission controller should be enabled?
ImagePolicyWebhook allows an external webhook to validate images based on signatures.
Why this answer
ImagePolicyWebhook is the admission controller that can enforce policies based on image signatures. Option C is correct.
Which of the following is a best practice for securing a Dockerfile?
Minimal base images reduce the number of packages and potential vulnerabilities.
Why this answer
Using a minimal base image like alpine reduces the attack surface. Running as root (option A) is insecure. Hardcoding secrets (option C) is a bad practice.
Using latest tags (option D) can lead to unexpected changes; pinned versions are preferred.
An OPA/Gatekeeper constraint is configured to require all container images to be from a specific registry. A user creates a Pod with image 'gcr.io/myimage:v1'. Which admission controller will first reject this Pod?
Gatekeeper enforces constraints via ValidatingAdmissionWebhook, which runs after mutating webhooks.
Why this answer
Gatekeeper's validating webhook (part of ValidatingAdmissionWebhook) enforces constraints. The admission flow: MutatingAdmissionWebhooks run first, then ValidatingAdmissionWebhooks. Since OPA/Gatekeeper uses a ValidatingAdmissionWebhook, it runs after mutating webhooks but before the final validation.
Which command would scan a Kubernetes Pod manifest for security issues?
Kubesec scans Kubernetes manifests for security issues.
Why this answer
Kubesec is a tool that scans Kubernetes resource manifests and provides security scores based on security best practices.
Which TWO are recommended practices for securing a CI/CD pipeline that builds container images? (Select two.)
Scanning catches CVEs early.
Why this answer
Scanning images for vulnerabilities and signing images are key supply chain security practices.
Which of the following is a best practice for securing container images in a Kubernetes environment?
Minimal images reduce the number of packages and thus potential vulnerabilities.
Why this answer
Using minimal base images like distroless or Alpine reduces the attack surface by including only necessary packages. Option B is correct.
You are configuring an ImagePolicyWebhook admission controller to allow only images from a trusted registry 'trusted-registry.io'. Which flag must be set in the kube-apiserver configuration to enable the webhook?
This flag points to a file that contains the configuration for ImagePolicyWebhook and other admission plugins.
Why this answer
Option C is correct. The --admission-control-config-file flag points to a configuration file that specifies the image policy webhook and other admission plugins. Option A is not a valid flag.
Option B is for enabling the webhook but does not specify the configuration file. Option D is for the old PodSecurityPolicy.
A security team wants to generate an SBOM for a container image. Which tool should they use?
Syft is a tool designed to generate Software Bill of Materials (SBOM) from container images and filesystems.
Why this answer
Syft generates SBOMs for container images. Trivy and Clair are vulnerability scanners. Cosign is for signing.
Syft is specifically designed for SBOM generation.
Which tool can generate an SBOM (Software Bill of Materials) from a container image?
Syft produces SBOMs in various formats (SPDX, CycloneDX) from container images.
Why this answer
Syft is a tool specifically designed to generate SBOMs from container images. Option A is correct.
An administrator wants to ensure that only images from a trusted registry 'myregistry.io' can run in the cluster. Which admission controller should be configured?
This admission controller calls a webhook to validate container images against a policy, e.g., allowlisting registries.
Why this answer
ImagePolicyWebhook allows you to configure an external webhook to validate images. OPA/Gatekeeper can also enforce registry allowlisting through constraint templates. However, ImagePolicyWebhook is the built-in admission controller specifically designed for image policy enforcement.
Which THREE are valid admission controllers in Kubernetes? (Select three.)
It is an admission controller that validates images.
Why this answer
MutatingAdmissionWebhook, ImagePolicyWebhook, and PodSecurity are valid admission controllers. Options A, C, and E are correct.
A CI/CD pipeline builds a Docker image and pushes it to a registry. To ensure supply chain security, the pipeline should scan the image for vulnerabilities before deployment. Which of the following is the correct command to scan a local Docker image using Trivy?
This command scans the specified container image for vulnerabilities.
Why this answer
The correct command to scan a local image with Trivy is 'trivy image <image-name>'. The other options are incorrect flags or commands.
Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?
Syft is designed to generate SBOMs from container images and filesystems.
Why this answer
Option D is correct. Syft is a CLI tool that generates SBOMs for container images. Trivy is for vulnerability scanning.
Cosign is for signing. Kubesec is for manifest scanning.
A security admin wants to ensure that all container images in a Kubernetes cluster are scanned for known vulnerabilities before being deployed. Which tool can be integrated into a CI/CD pipeline to scan container images for CVEs?
Trivy is a popular open-source vulnerability scanner for container images, supporting multiple formats and databases.
Why this answer
Trivy is a comprehensive vulnerability scanner for container images, filesystems, and Git repositories. It can be integrated into CI/CD pipelines to scan images before deployment.
A cluster has both ImagePolicyWebhook and a mutating webhook that adds a sidecar. The admin notices that even when ImagePolicyWebhook rejects an image, the mutating webhook has already added the sidecar. What admission ordering issue is occurring?
Reordering ensures the image policy is evaluated before any mutation.
Why this answer
Mutating webhooks run before validating webhooks. If a mutating webhook runs first, it may modify the pod spec, and the validation may see the modified version.
You want to allow only images from a specific registry (e.g., myregistry.io) to be deployed in your cluster. Which tool or approach is best suited for this requirement?
Gatekeeper can enforce policies on images, including allowing only certain registries.
Why this answer
OPA/Gatekeeper can be used to create a ConstraintTemplate that validates image registries. Kyverno is another option, but Gatekeeper is specifically designed for policy enforcement.
An organization uses a private container registry and wants to ensure that only images built from a specific CI/CD pipeline are deployed. Which combination of measures provides the strongest guarantee?
Attestations provide non-repudiation and can be verified at admission time.
Why this answer
Option E is correct because it implements a complete chain of custody for container images. In-toto generates signed attestations that record every step of the CI/CD pipeline (e.g., source code checkout, build, test), and an admission webhook like Kyverno verifies these attestations before allowing a pod to run. This ensures that only images that passed the exact, attested pipeline are deployed, providing the strongest guarantee against unauthorized or tampered images.
Exam trap
CNCF often tests the distinction between access control measures (network policies, RBAC, firewalls) and cryptographic provenance verification; candidates mistakenly think restricting registry access or network egress is sufficient, but the exam emphasizes that only signed attestations with admission control can guarantee the image was built by the intended pipeline.
How to eliminate wrong answers
Option A is wrong because network policies restrict egress from pods to the registry, which controls runtime access but does not verify the provenance or integrity of the image itself; an attacker could still deploy a malicious image that was built outside the CI/CD pipeline. Option B is wrong because granting registry write access only to the CI system's service account prevents unauthorized pushes but does not prevent the CI system itself from being compromised or building images from untrusted sources; it lacks verification of the build process. Option C is wrong because static analysis of the Dockerfile checks for vulnerabilities or misconfigurations in the build instructions but does not provide any cryptographic proof that the resulting image was actually built from that Dockerfile in the approved pipeline.
Option D is wrong because using a unique registry path and firewall rules restricts network access but does not verify the image's supply chain; an attacker who gains access to the registry path could push arbitrary images.
Which TWO of the following are valid methods to verify the integrity of a container image before deployment?
Using the digest ensures that the exact image content is used, preventing tag mutability attacks.
Why this answer
Image signing with Cosign allows verification of the image's integrity and origin. Image digest ensures the exact image content is used. SBOM provides a list of components but does not verify integrity.
Vulnerability scanning identifies issues but does not verify integrity. Using latest tag does not provide integrity.
An administrator applies the following Kyverno policy to the cluster. What is the effect of this policy? apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: require-non-root spec: validationFailureAction: enforce rules: - name: check-runAsNonRoot match: resources: kinds: - Pod validate: message: "Running as root is not allowed." pattern: spec: securityContext: runAsNonRoot: true
The policy requires runAsNonRoot: true. If the security context is missing entirely, the field is not set, so the validation fails and the Pod is denied.
Why this answer
The policy enforces that all Pods must have 'runAsNonRoot: true' in their security context. If a Pod does not have this setting, it will be rejected (enforce mode).
Which of the following is a static analysis tool for Kubernetes manifests that can identify security misconfigurations?
kubesec performs static analysis of Kubernetes YAML files to identify security risks.
Why this answer
Option A is correct. kubesec is a tool that analyzes Kubernetes resource manifests for security issues. Clair is for image scanning. Notary is for image signing.
OPA/Gatekeeper is for admission control, not static analysis.
You are tasked with creating a Kubernetes admission controller that validates image signatures before allowing pods to run. Which admission controller should you configure?
ImagePolicyWebhook is an admission controller specifically for image policy validation, often used with image signing.
Why this answer
ImagePolicyWebhook is the admission controller that can be configured to validate images against an external webhook, typically used for image signature verification.
Which TWO of the following tools can be used to generate or analyze SBOMs? (Select 2)
Syft is a dedicated SBOM generation tool.
Why this answer
Syft generates SBOMs, and Trivy can also generate SBOMs (in addition to vulnerability scanning). Cosign is for signing, Kubesec is for manifest analysis, and Checkov is for infrastructure-as-code scanning.
Which of the following is a best practice for securing container images?
Distroless images contain only essential components, reducing the number of potential vulnerabilities.
Why this answer
Using minimal base images reduces the attack surface. Distroless images contain only the application and its runtime dependencies, reducing vulnerabilities.
A security audit reveals that a Deployment uses an image with a mutable tag 'app:latest'. Which change ensures the image is immutable and traceable?
Using a digest ensures the exact image layer is used, providing immutability.
Why this answer
Using a SHA digest ensures the image is immutable and exactly the same version each time. Option C is correct.
Arrange the steps to secure etcd in a Kubernetes cluster.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Securing etcd involves TLS configuration, restarting, health verification, and network restriction.
Which TWO of the following are best practices for securing the container supply chain?
Scanning helps catch known vulnerabilities early.
Why this answer
Scanning images for vulnerabilities in a CI pipeline before deployment is a best practice because it catches known CVEs early, preventing vulnerable images from reaching production. Tools like Trivy, Clair, or Grype integrate into CI/CD to enforce policy gates, ensuring only compliant images proceed.
Exam trap
CNCF often tests the distinction between 'scanning for vulnerabilities' (Option A) and 'signing for integrity' (Option B) as complementary but distinct practices, and the trap is that candidates might think only one is needed or confuse signing with scanning.
A developer wants to ensure the container image used in a Deployment is immutable. Which approach BEST guarantees that the exact same image is used every time, preventing tag mutation?
Digests are immutable and guarantee the exact image content.
Why this answer
Using a digest (SHA256) ensures that the image identifier is unique to the content, making it immutable. Tags like 'v1.0' can be overwritten.
Which THREE of the following are required to implement a secure software supply chain using Kubernetes native features?
Scanning prevents deployment of images with known vulnerabilities.
Why this answer
Option A is correct because vulnerability scanning tools like Trivy or Grype are essential for identifying known CVEs in container images before deployment. Integrating these tools into the CI/CD pipeline ensures that only images with an acceptable vulnerability posture are built and pushed to the registry, forming a foundational security gate in the software supply chain.
Exam trap
CNCF often tests the misconception that disabling security controls (like admission controllers) is acceptable for performance, when in fact it undermines the entire supply chain security model.
Which TWO of the following tools can generate an SBOM (Software Bill of Materials) for a container image?
syft is a dedicated SBOM generation tool.
Why this answer
Correct answers: A and D. syft and cosign attest (specifically 'cosign attest --predicate sbom' or using cosign with an SBOM) are tools that can generate SBOMs. Trivy can also generate SBOMs (trivy image --format spdx), but the question asks specifically for tools that can generate SBOM. Trivy is primarily a scanner, but it can generate SBOM.
However, the most common dedicated SBOM tools are syft and cosign attest. Clair and Snyk are vulnerability scanners, not SBOM generators. Option E (kubesec) is for static analysis of manifests.
A security team wants to ensure that only container images from a trusted registry (mytrustedregistry.io) are deployed in the cluster. They plan to use OPA/Gatekeeper. Which kind of Gatekeeper constraint template and constraint should they create?
By matching the 'image' field in containers, you can ensure only images from trusted registries are used.
Why this answer
Option B is correct. A K8sAllowedRegions constraint template on the spec.containers[*].image field can enforce that image names match a specific registry. Option A is too broad.
Option C uses an incorrect field. Option D targets an irrelevant field.
You have configured Kyverno to enforce that all Pods must have an image from a trusted registry. However, a newly created Pod is not being rejected even though it uses an untrusted image. What is the most likely reason?
If the webhook's failure policy is 'Ignore', a failing webhook will not block the request. Also, the policy may not match the namespace or other criteria.
Why this answer
Option D is correct. Kyverno policies are implemented as a MutatingAdmissionWebhook or ValidatingAdmissionWebhook, and they must be properly configured with the correct failurePolicy and match conditions. If the webhook is not properly configured, the request may bypass the policy.
Option A is wrong because Kyverno uses webhooks, not the ImagePolicyWebhook. Option B is not specific to this issue. Option C is wrong because Kyverno can validate resources without an external registry.
An admin runs 'kubectl run nginx --image=nginx' and the pod fails with 'ImagePullBackOff'. The cluster has an OPA/Gatekeeper constraint that only allows images from 'myregistry.io'. How can the admin quickly test the restriction?
If the constraint allowlists 'myregistry.io', then using an image from that registry should pass the admission check.
Why this answer
The constraint restricts images to a specific registry. The admin should use an image from that registry to succeed. Option A is correct.
Ready to test yourself?
Try a timed practice session using only Cks Supply Chain questions.