Your security team uses Trivy to scan images in CI. They want to block deployments of images with critical vulnerabilities in the production cluster, but allow them in development. Which approach should you take?

Set the imagePullPolicy to IfNotPresent on all Deployments.

Use the Trivy admission controller with a policy that denies images with critical vulnerabilities in the production namespace.

Use a PodSecurityPolicy to restrict privileged containers.

Run Trivy as a CronJob in the cluster and store results in a ConfigMap.

Your team uses cosign to sign images in CI. You want to ensure that the public key used for verification is rotated regularly without downtime. Which approach should you use?

Replace the Secret with a new key and immediately delete the old one.

Disable signature verification during the rotation period.

Store multiple public keys in a Kubernetes Secret and configure the admission controller to accept signatures from any of them.

Use a single key and rotate it only during maintenance windows.

What is the purpose of enforcing a policy that blocks the deployment of images with known critical vulnerabilities?

To prevent vulnerable images from running in the cluster and reducing the risk of exploitation

To improve the performance of the container runtime

To ensure images are signed by a trusted authority

To reduce the size of container images

Your organization requires that all images come from registry.corp.example.com and are signed with cosign. You need to enforce both requirements. Which admission controller configuration should you use?

Deploy both a ValidatingAdmissionPolicy for the registry and the cosign admission controller for signatures.

Use only a ValidatingAdmissionPolicy for the registry and rely on CI for signatures.

Use a single ValidatingAdmissionPolicy that checks both the registry and the signature.

Use only the cosign admission controller and rely on CI to enforce the registry.

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 3

Secure Your Supply Chain (permitted Registries, Sign and Validate Artifacts, Etc.) CKS Practice Questions (Page 1)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

20%of the exam

Questions 1–5

1application · medium
Your security team uses Trivy to scan images in CI. They want to block deployments of images with critical vulnerabilities in the production cluster, but allow them in development. Which approach should you take?
Select an answer first
2application · medium
Your team uses cosign to sign images in CI. You want to ensure that the public key used for verification is rotated regularly without downtime. Which approach should you use?
Select an answer first
3foundation · easy
Which tool is specifically designed to scan container images for known vulnerabilities?
Select an answer first
4foundation · easy
What is the purpose of enforcing a policy that blocks the deployment of images with known critical vulnerabilities?
Select an answer first
5application · medium
Your organization requires that all images come from registry.corp.example.com and are signed with cosign. You need to enforce both requirements. Which admission controller configuration should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.