CKS Supply Chain Security Practice Question
Which THREE of the following are best practices for securing the software supply chain in Kubernetes?
⚠ Common exam trap
The CNCF CKS exam often tests the misconception that running containers as root is acceptable for 'simplicity' or that mutable tags are harmless, but both directly undermine supply chain security guarantees.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign container images and verify signatures in the CI/CD pipeline
Option B is correct because cryptographically signing container images (e.g., with Sigstore/Cosign or Notary) and verifying those signatures in the CI/CD pipeline ensures that only trusted, unmodified images are deployed, preventing tampering and supply-chain injection. Option C is correct because admission controllers such as OPA/Gatekeeper (or Kyverno) enforce policies at admission time, blocking images that violate rules like untrusted registries, missing signatures, or disallowed configurations before pods are created. Option E is correct because scanning images for known CVEs (e.g., with Trivy, Grype, or Clair) before deployment identifies vulnerable dependencies and base images, allowing remediation prior to production. Option A is not a best practice: running containers as root violates least privilege and increases the blast radius of a compromise; instead, use non-root users and restricted security contexts. Option D is not a best practice: mutable tags like 'latest' are non-deterministic and can silently pull different images, undermining reproducibility and integrity; immutable, digest-pinned tags should be used instead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run containers as root to avoid permission issues
Why it's wrong here
Running containers as root grants any compromised process full node-level privileges, defeating the isolation that Pod Security Standards and non-root UID enforcement provide. Root is tempting because it sidesteps volume ownership and bind-port errors during quick deployments, but that convenience is exactly the misconfiguration CKS expects you to eliminate.
- ✓
Sign container images and verify signatures in the CI/CD pipeline
Why this is correct
Signing images with tools like Cosign and verifying those signatures during CI/CD ensures tampered or unauthorised artefacts never reach the registry or cluster. This satisfies the supply chain requirement by establishing cryptographic provenance before deployment, catching compromise at the earliest pipeline stage.
- ✓
Use admission controllers like OPA/Gatekeeper to enforce image policies
Why this is correct
OPA/Gatekeeper acts as a validating admission controller, evaluating images against Rego policies at admission time. This enforces image policies cluster-wide, rejecting non-compliant workloads before they run, which satisfies the supply chain requirement by preventing untrusted images from being scheduled.
- ✗
Use mutable tags like 'latest' for easier updates
Why it's wrong here
Mutable tags such as 'latest' let a redeployed image resolve to different content, defeating digest pinning and allowing an attacker who compromises the registry to substitute code without any manifest change. Floating tags suit rapid development iteration, but for supply-chain integrity Kubernetes admission should enforce immutable digests.
- ✓
Scan container images for known vulnerabilities before deployment
Why this is correct
Scanning images before deployment detects known CVEs in base layers and dependencies, preventing vulnerable artefacts from reaching the cluster. This directly enforces supply chain integrity at the point where third-party code enters the Kubernetes environment.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Secrets Management and Encryption
Key term
Image Scanning
Image scanning is the automated process of inspecting container images for known vulnerabilities, misconfigurations, and malware before they are deployed into production environments.
Key term
Admission Controllers
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.