CCSP Cloud Platform and Infrastructure Security Practice Question
A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?
⚠ Common exam trap
The trap is confusing vulnerability scanning tools (Clair, Trivy, Snyk) with image signing and verification tools (Cosign), leading candidates to pick a scanner when the requirement is signature enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cosign
Cosign is a tool from the Sigstore project that signs and verifies container images. It integrates with Kubernetes admission controllers (e.g., via Kyverno or OPA Gatekeeper policies) to enforce that only images with valid signatures from a trusted registry are deployed. This directly addresses the requirement to enforce signed images at admission time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Clair
Why it's wrong here
Clair scans image layers for known CVEs; it cannot verify signatures or block deployments at admission. It is tempting because Clair is a legitimate container vulnerability scanner, and it would be the right tool when the requirement is detecting vulnerable packages rather than enforcing signed images.
- ✗
Trivy
Why it's wrong here
Trivy detects vulnerabilities, misconfigurations and secrets in images, but it does not validate signatures or act as an admission controller. It is tempting as a widely used scanner, and it would be correct when the goal is scanning images for CVEs before they reach the cluster.
- ✓
Cosign
Why this is correct
Cosign signs container images and stores signatures in the registry, letting an admission controller verify provenance before pods are admitted. This enforces the trusted-registry constraint at admission time, rejecting any unsigned or tampered image before it reaches the cluster.
- ✗
Snyk Container
Why it's wrong here
Snyk Container scans images for vulnerabilities and licence issues; it does not verify signatures or enforce policy at admission. It is tempting because Snyk integrates into CI pipelines, and it would be the right choice when the requirement is identifying vulnerable dependencies during image builds.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.