CKS Supply Chain Security Practice Question
Which tool can be used to generate an SBOM (Software Bill of Materials) for a container image?
⚠ Common exam trap
CKS often tests the distinction between a dedicated SBOM generator (Syft) and a vulnerability scanner that can also produce SBOMs (Trivy), leading candidates to pick Trivy because they associate it with container security, but the question specifically asks for a tool 'to generate an SBOM', not to scan for vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
syft
Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to catalog packages (e.g., APK, DEB, RPM, Python, Java) and outputs the SBOM in formats like SPDX or CycloneDX, which are industry standards for supply chain transparency. This makes it the correct choice for generating an SBOM from a container image in a CKS context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
trivy
Why it's wrong here
Trivy scans for vulnerabilities, but does not primarily generate SBOMs (though it can list packages).
- ✗
kubesec
Why it's wrong here
kubesec is for static analysis of Kubernetes manifests.
- ✗
checkov
Why it's wrong here
Checkov scans infrastructure as code.
- ✓
syft
Why this is correct
Syft generates SBOMs from container images.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on CKS
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?
easy- A.kubesec
- ✓ B.syft
- C.trivy
- D.cosign
Why B: Syft is a CLI tool purpose-built for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to extract package metadata (e.g., dpkg, RPM, APK, Python, Node.js) and outputs the SBOM in formats like CycloneDX or SPDX, which are the industry standards for supply chain transparency.
Variation 2. Which tool is specifically designed to generate a Software Bill of Materials (SBOM) for container images?
easy- A.Checkov
- B.Cosign
- ✓ C.Syft
- D.Trivy
Why C: Syft is an open-source CLI tool developed by Anchore specifically for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to catalog packages, libraries, and dependencies in formats such as CycloneDX and SPDX, making it the correct choice for this purpose.
Variation 3. Which tool can generate an SBOM (Software Bill of Materials) from a container image?
easy- ✓ A.syft
- B.kubesec
- C.trivy
- D.checkov
Why A: Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses static analysis to extract package metadata from package managers (e.g., dpkg, RPM, APK) and produces SBOMs in formats like SPDX and CycloneDX, directly addressing the requirement for supply chain transparency.
Variation 4. Which tool is used to generate an SBOM (Software Bill of Materials) for a container image?
easy- A.Clair
- B.Kubesec
- C.Trivy
- ✓ D.Syft
Why D: Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses a pluggable cataloger system to extract package metadata (e.g., dpkg, RPM, APK, Python, Java JARs) and outputs the SBOM in formats like CycloneDX or SPDX, which are the standard formats for supply chain transparency.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.