CCSP Cloud Platform and Infrastructure Security Practice Question
A cloud security team wants to enforce that only signed container images are deployed in their Kubernetes cluster. Which admission controller can validate image signatures at deploy time?
⚠ Common exam trap
CCSP often tests the confusion between security tools that scan images (like Trivy) and those that enforce policies at admission time (like Kyverno), so candidates must distinguish between detection and enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kyverno
Kyverno is a Kubernetes-native policy engine that functions as a validating admission controller. It can enforce policies that check container image signatures (e.g., using Cosign) at deploy time by validating the image's signature against a public key before allowing the pod to be created. This directly satisfies the requirement to only allow signed images.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HashiCorp Vault
Why it's wrong here
Vault stores and issues secrets; it cannot intercept Kubernetes admission requests or verify image signatures at deploy time. It is the right tool for centralised secret management and dynamic credentials, not for signature validation during pod admission.
- ✗
Consul
Why it's wrong here
Consul is a service-mesh and service-discovery platform; it performs no Kubernetes admission-time image signature verification. It tempts because it handles service identity and mTLS, which suits securing service-to-service traffic, not validating container image signatures before pods are admitted.
- ✗
Trivy
Why it's wrong here
Trivy scans images for known vulnerabilities and misconfigurations, but it does not act as an admission controller enforcing signature validation at deploy time. It tempts because it inspects container images, which fits CI pipeline scanning, not blocking unsigned workloads from entering the cluster.
- ✓
Kyverno
Why this is correct
Kyverno is a Kubernetes admission controller that evaluates policies at deploy time, including verifying container image signatures against trusted keys. It satisfies the requirement to block unsigned images before they are admitted to the cluster.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.