CKS Supply Chain Security Practice Question
Which static analysis tool is specifically designed to evaluate Kubernetes manifests against security best practices?
⚠ Common exam trap
CKS often tests the distinction between tools that scan images (clair, trivy, syft) and tools that scan manifests (kubesec, kube-score, checkov), so candidates must match the tool to the artifact being analyzed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubesec
kubesec is a static analysis tool specifically designed to scan Kubernetes manifests and identify security risks, such as running containers as root, missing resource limits, or privileged mode. It evaluates YAML files against a set of security best practices and assigns a risk score. This makes it the correct tool for evaluating Kubernetes manifests against security best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
cosign
Why it's wrong here
Cosign signs and verifies container images and other artefacts, providing supply-chain integrity rather than manifest inspection. It does not evaluate Kubernetes YAML against security best practices. Cosign would be the correct choice when enforcing signature verification in an admission or CI pipeline.
- ✗
syft
Why it's wrong here
Syft generates a software bill of materials by scanning container images and filesystems for installed packages; it does not parse Kubernetes YAML or flag misconfigurations such as privileged containers or missing security contexts. It would be the right tool when you need an SBOM for vulnerability or licence tracking, not manifest hardening.
- ✓
kubesec
Why this is correct
Kubesec analyses Kubernetes manifests directly, scoring workloads against security controls such as privileged containers, host namespaces, and capability escalation. It satisfies the stem's constraint of evaluating manifests against best practices, unlike runtime tools or general linters. Its risk-scoring output pinpoints misconfigurations before deployment.
- ✗
clair
Why it's wrong here
Clair scans container images for known vulnerabilities in installed packages; it does not parse Kubernetes YAML manifests or evaluate their security settings. A manifest-focused static analyser is required here. Clair would be the correct choice when assessing image layers for CVEs before deployment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.