Your CI pipeline scans images with Trivy and stores the results in a database. You want to enforce a policy that blocks images with critical vulnerabilities in production, but you also have a legacy image that is known to have a critical vulnerability and is required for a legacy application. You cannot update the image. What is the best approach?

Create an admission policy that denies images with critical vulnerabilities, but add an exception for the specific legacy image digest.

Use a NetworkPolicy to isolate the legacy application.

Block the legacy image and require the team to update it.

Allow all images with critical vulnerabilities in production.

Your organization has a policy that all images must come from registry.corp.example.com. You need to enforce this in the cluster, but you also need to allow images from a specific mirror registry for one team. What is the best approach?

Allow the mirror registry cluster-wide.

Use a NetworkPolicy to block egress to the mirror registry.

Block the mirror registry immediately.

Create an admission policy that allows the mirror registry for the specific team's namespace and blocks it elsewhere.

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 3

Secure Your Supply Chain (permitted Registries, Sign and Validate Artifacts, Etc.) CKS Practice Questions (Page 2)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

20%of the exam

Questions 6–10

6foundation · easy
Which Kubernetes admission controller can be used to enforce custom supply chain security policies, such as requiring images to come from approved registries and be signed?
Select an answer first
7foundation · easy
Which admission controller is commonly used to enforce that only images from approved registries can be deployed in a Kubernetes cluster?
Select an answer first
8foundation · easy
Which tool is commonly used to sign container images and verify their signatures before deployment?
Select an answer first
9expert · hard
Your CI pipeline scans images with Trivy and stores the results in a database. You want to enforce a policy that blocks images with critical vulnerabilities in production, but you also have a legacy image that is known to have a critical vulnerability and is required for a legacy application. You cannot update the image. What is the best approach?
Select an answer first
10application · medium
Your organization has a policy that all images must come from registry.corp.example.com. You need to enforce this in the cluster, but you also need to allow images from a specific mirror registry for one team. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Secure Your Supply Chain (permitted Registries, Sign and Validate Artifacts, Etc.) CKS Practice Questions (Page 2)

Questions 6–10

Which Kubernetes admission controller can be used to enforce custom supply chain security policies, such as requiring images to come from approved registries and be signed?

Which admission controller is commonly used to enforce that only images from approved registries can be deployed in a Kubernetes cluster?

Which tool is commonly used to sign container images and verify their signatures before deployment?

Your organization has a policy that all images must come from registry.corp.example.com. You need to enforce this in the cluster, but you also need to allow images from a specific mirror registry for one team. What is the best approach?

Keep studying — Minimize Microservice Vulnerabilities