CKS Supply Chain Security Practice Question
Which TWO of the following tools can generate an SBOM (Software Bill of Materials) for a container image?
⚠ Common exam trap
Candidates often assume that only dedicated SBOM tools (like Syft) can generate an SBOM, forgetting that Cosign attest with the `--type sbom` flag also produces an SBOM. This leads to selecting only one correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
syft
Syft (A) is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. Cosign attest (B) can also generate an SBOM for a container image using the `--type sbom` flag and attach it as an in-toto attestation. Both tools are capable of producing SBOMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
syft
Why this is correct
syft is a dedicated SBOM generation tool.
- ✓
cosign attest
Why this is correct
cosign attest can attach an SBOM as an in-toto attestation.
- ✗
Clair
Why it's wrong here
Clair is a vulnerability scanner, not an SBOM generator.
- ✗
kubesec
Why it's wrong here
Kubesec performs static security analysis of Kubernetes resource manifests by evaluating them against a built-in set of risk policies, but it never inspects the filesystem layers or package metadata of a container image, so it cannot enumerate the software components required for an SBOM. It is tempting because its name suggests a security tool for containers, and in a scenario requiring Kubernetes manifest security auditing, Kubesec would be the correct choice.
- ✗
Snyk
Why it's wrong here
Snyk is a vulnerability scanner; it can generate SBOM as part of its features but is not primarily known for that. The common answer is syft.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Container Image Security
Key term
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.