CKS Supply Chain Security Practice Question
You are tasked with ensuring that all container images in your cluster are scanned for vulnerabilities before being deployed. You have set up Trivy in your CI/CD pipeline and want to enforce that only images with no critical vulnerabilities are allowed. Which admission controller should you configure to reject pods using non-compliant images?
⚠ Common exam trap
A common trap is confusing ImagePolicyWebhook (purpose-built for image policy) with ValidatingAdmissionWebhook (generic validation). Candidates often choose ValidatingAdmissionWebhook because they overlook the specialized nature of ImagePolicyWebhook for image scanning enforcement in Kubernetes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ImagePolicyWebhook
The ImagePolicyWebhook admission controller is specifically designed to evaluate container images against an external policy backend (e.g., Trivy) before they are admitted into the cluster. It intercepts pod creation requests, sends the image reference to an external webhook for validation, and rejects pods whose images contain critical vulnerabilities. This makes it the correct choice for enforcing image vulnerability policies at admission time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ImagePolicyWebhook
Why this is correct
ImagePolicyWebhook is a dedicated Kubernetes admission controller that intercepts Pod creation and update requests, extracts the image references, and sends them to an external HTTP(S) backend for a decision based on scanning or policy rules. It is designed specifically for image policy enforcement, with configuration for fail-open/fail-closed behavior and support for default image policies like allowed registries or prefixes. This makes it the standard mechanism to reject images that fail security scanning before they are scheduled.
- ✗
ValidatingAdmissionWebhook
Why it's wrong here
A ValidatingAdmissionWebhook is a general-purpose hook that can validate any API resource, but it requires you to implement the entire image policy logic, including connecting to a scanner and parsing the AdmissionReview payload yourself. Unlike the ImagePolicyWebhook controller, it does not provide a built-in configuration format tailored to image checks, nor does it integrate with image scanning workflows out of the box. While it can technically block a Pod with a vulnerable image, it is not the designated or operationally effective solution for this specific requirement.
- ✗
PodSecurityPolicy (PSP)
Why it's wrong here
PodSecurityPolicy (PSP) is a deprecated admission controller that enforces security context constraints on Pods, such as disallowing privileged containers, controlling host namespaces, and restricting volume types or user IDs. It has no mechanism to inspect container image contents, check for known vulnerabilities, or assess the trustworthiness of image sources. Because PSP was removed in Kubernetes 1.25 and its successor Pod Security Admission focuses on security profiles rather than image integrity, it cannot fulfill an image policy requirement.
- ✗
ResourceQuota
Why it's wrong here
ResourceQuota is an admission controller that enforces aggregate limits on a namespace's resource consumption, including CPU, memory, storage requests, and object counts such as the number of Pods or Services. It operates exclusively on resource quantities and has no visibility into the container images referenced by a Pod, so it cannot evaluate vulnerability scan results or block images based on registry provenance. Using ResourceQuota to attempt image security enforcement would be conceptually orthogonal and completely ineffective.
Go deeper
Related to this question
Learn chapter
Cluster Setup: Secure Configuration and Best Practices
Key term
Image Scanning
Image scanning is the automated process of inspecting container images for known vulnerabilities, misconfigurations, and malware before they are deployed into production environments.
Key term
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.