Understand Your Supply Chain (e.g. SBOM, CI/CD, Artifact Repositories) CKS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   Your artifact repository stores both internal and third-party artifacts. You want to ensure that all artifacts are authentic and have not been tampered with. Which mechanism is most appropriate?

   • ARestrict access to the repository to a small group of administrators.
   • BEnable repository-level signing and verification for all artifacts.
   • CUse checksums only for large files.
   • DRegularly back up the repository to an external location.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a best practice for securing secrets in a CI/CD pipeline?

   • ACommit secrets to the repository for easy access
   • BShare secrets via email to team members
   • CStore secrets in environment variables in the pipeline configuration
   • DUse a dedicated secret management tool and reference secrets dynamically
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   Your organization wants to enforce that only images with a valid signature from your CI/CD pipeline can be deployed. You have implemented image signing, but you also want to allow emergency hotfixes that are built outside the pipeline. How can you balance security and operational flexibility?

   • AUse the same signing key for all builds, including emergency ones.
   • BDisable signature verification in the admission controller during emergencies.
   • CCreate a separate signing key for emergency builds and configure the admission controller to accept signatures from both keys.
   • DRequire manual approval from a security team for emergency images.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your CI/CD pipeline uses a service account to push images to a container registry. You want to minimize the risk of credential leakage while maintaining the ability to push images. Which practice is most effective?

   • AUse a service account with broad permissions and rotate the key annually.
   • BHardcode the credentials in the pipeline configuration file.
   • CUse a short-lived token generated by the registry's identity provider for each pipeline run.
   • DStore the registry credentials as a Kubernetes secret and mount them into the pipeline pod.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to scan container images for vulnerabilities in a CI/CD pipeline?

   • ATo identify known vulnerabilities in the image's components before deployment
   • BTo speed up the build process
   • CTo ensure the image is small in size
   • DTo verify the image was built from a trusted base image
   Reveal Solution Discussion Select an answer first