Understand Your Supply Chain (e.g. SBOM, CI/CD, Artifact Repositories) CKS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   Your organization wants to enforce that only container images with verifiable provenance from your internal CI/CD pipeline can be deployed to production. You have implemented image signing. What additional control is necessary to enforce this policy at deployment time?

   • ACreate a NetworkPolicy that only allows traffic to the internal registry.
   • BUse a private registry and require developers to pull images from it.
   • CConfigure the cluster's admission controller to verify image signatures before allowing pod creation.
   • DSet the imagePullPolicy to Always in all deployments.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   Your organization's CI/CD pipeline uses a base image from a public registry. An attacker compromises the public registry and replaces the base image with a malicious one. Your pipeline does not verify the base image's integrity. What is the most effective way to prevent this attack in the future?

   • AUse a tag like 'latest' and regularly update the base image.
   • BPin the base image to a specific digest and verify the digest in the pipeline before building.
   • CUse a private registry and copy the base image there.
   • DScan the base image for vulnerabilities before building.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your organization uses a central artifact repository (e.g., JFrog Artifactory or Sonatype Nexus) to store libraries and container images. You are concerned about a developer accidentally pushing a malicious package that could be used by other teams. Which control is most effective in preventing this?

   • AEnable repository-level vulnerability scanning and block uploads that contain critical vulnerabilities.
   • BRequire all artifacts to be signed by the development team.
   • CUse a proxy repository that caches artifacts from the public internet.
   • DRestrict write access to the repository to a small group of administrators.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your CI/CD pipeline builds and pushes container images to a private registry. You want to ensure that only images built from your trusted pipeline are deployed to production. Which combination of controls would best enforce this?

   • AUse a strong password for the registry and restrict access to the pipeline service account.
   • BUse a unique tag for each build and maintain a list of approved tags in a ConfigMap.
   • CScan images for vulnerabilities in the pipeline and block deployment if critical vulnerabilities are found.
   • DSign images with a private key in the pipeline and configure the cluster to verify signatures before pulling.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a routine audit, you discover that a popular open-source library used in your application was compromised by an attacker who injected malicious code into a published version. Your application uses a version range that includes the compromised version. Which immediate action is most appropriate?

   • AAdd a network policy to block the library's download URL.
   • BPin the dependency to a known-good version and rebuild the application.
   • CRemove the dependency from the application entirely.
   • DUpdate the dependency to the latest version available.
   Reveal Solution Discussion Select an answer first