Secure Your Supply Chain (permitted Registries, Sign and Validate Artifacts, Etc.) CKS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   Your cluster runs a mix of workloads: some use images from the approved internal registry, and some use images from a legacy external registry that is still needed for one month. You must enforce that all images are signed, but the legacy registry does not support signing. You cannot change the legacy registry. What is the best approach?

   • ADisable admission control entirely until the legacy registry is decommissioned.
   • BBlock all images from the legacy registry immediately.
   • CCreate an admission policy that requires signatures for images from the internal registry and exempts the legacy registry for now.
   • DRequire signatures for all images, including the legacy registry.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your team signs container images with cosign using a private key. You want to ensure that only images signed by your team's key can run in the production cluster. Which admission controller setup should you implement?

   • AUse the OPA Gatekeeper with a ConstraintTemplate that checks the imagePullSecrets field in Pod specs.
   • BConfigure the kubelet's --image-credential-provider-bin-dir to point to a custom credential provider.
   • CEnable the AlwaysPullImages admission plugin to force image pulls.
   • DUse the cosign admission controller with a Kubernetes Secret containing the public key to verify signatures.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your organization mandates that all container images must come from the internal registry at registry.corp.example.com. Developers sometimes push images to Docker Hub for testing. You need to enforce this policy cluster-wide. Which admission controller configuration should you use?

   • ASet the imagePullPolicy to Always on all Deployments.
   • BConfigure the kubelet's --pod-infra-container-image flag to point to the internal registry.
   • CDeploy a ValidatingAdmissionPolicy that checks the image field in Pod specs and denies if the registry hostname is not registry.corp.example.com.
   • DUse a NetworkPolicy to block egress traffic to Docker Hub.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your team signs images with cosign and also scans them with Trivy in CI. You want to ensure that only signed and vulnerability-free images are deployed. Which admission controller configuration should you use?

   • AUse only the Trivy admission controller and rely on CI to sign images.
   • BUse only the cosign admission controller and rely on CI to scan for vulnerabilities.
   • CUse a single admission controller that combines both features.
   • DDeploy both the cosign admission controller and the Trivy admission controller, and configure both to deny non-compliant images.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   Your cluster has multiple teams. Team A uses images from registry.corp.example.com and signs them with cosign. Team B uses images from the same registry but does not sign them. You need to enforce that all images in the cluster are signed, but you cannot break Team B's workloads. What is the best approach?

   • AExempt Team B's namespaces from the signing policy permanently.
   • BBlock Team B's images immediately until they sign them.
   • CRequire signatures only for images from the internal registry.
   • DRequire signatures for all images, and work with Team B to sign their images before enforcing the policy.
   Reveal Solution Discussion Select an answer first