Your cluster has a mix of namespaces. The 'production' namespace must only use images from registry.corp.example.com, while other namespaces can use any registry. You need to enforce this with an admission controller. What is the most efficient configuration?

Configure the kubelet to only pull from the internal registry.

Use a NetworkPolicy to block egress to external registries from the production namespace.

Use a ValidatingAdmissionPolicy that checks the namespace label and the image registry, denying non-compliant images in production.

Deploy a separate admission webhook for each namespace.

What is the primary goal of implementing supply chain security policies in a Kubernetes cluster?

To increase the speed of image pulls

To reduce the number of containers running in the cluster

To ensure that only trusted and verified artifacts are deployed

To simplify the deployment process for developers

What is the primary purpose of configuring the container runtime to allow only images from approved registries?

To improve image pull performance by caching images from a single registry

To reduce the attack surface by preventing unauthorized or malicious images from being pulled

To simplify image naming conventions across the cluster

To comply with network bandwidth limits imposed by cloud providers

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 3

Secure Your Supply Chain (permitted Registries, Sign and Validate Artifacts, Etc.) CKS Practice Questions (Page 4)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

20%of the exam

Questions 16–18

16application · medium
Your cluster has a mix of namespaces. The 'production' namespace must only use images from registry.corp.example.com, while other namespaces can use any registry. You need to enforce this with an admission controller. What is the most efficient configuration?
Select an answer first
17foundation · easy
What is the primary goal of implementing supply chain security policies in a Kubernetes cluster?
Select an answer first
18foundation · easy
What is the primary purpose of configuring the container runtime to allow only images from approved registries?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Secure Your Supply Chain (permitted Registries, Sign and Validate Artifacts, Etc.) CKS Practice Questions (Page 4)

Questions 16–18

Your cluster has a mix of namespaces. The 'production' namespace must only use images from registry.corp.example.com, while other namespaces can use any registry. You need to enforce this with an admission controller. What is the most efficient configuration?

What is the primary goal of implementing supply chain security policies in a Kubernetes cluster?

What is the primary purpose of configuring the container runtime to allow only images from approved registries?

Keep studying — Minimize Microservice Vulnerabilities