Why should artifact repositories be scanned for vulnerabilities?

To automatically fix any vulnerabilities found

To ensure artifacts are free of malware and known vulnerabilities

To reduce the storage space used by artifacts

To improve the download speed of artifacts

Your organization builds a container image from a base image that includes a popular open-source library. During a security review, you need to quickly identify all third-party components and their versions in the final image to assess exposure to a newly disclosed vulnerability. Which approach best achieves this?

Inspect the Dockerfile to list the base image and any packages installed via RUN commands.

Generate an SBOM for the image during the CI/CD pipeline and store it alongside the image.

Use `docker history` to view the image layers and infer the components from the layer metadata.

Run a vulnerability scanner against the running container and review the scan report.

You have an SBOM for a container image that is about to be deployed. A new critical vulnerability is disclosed in a library that is listed in the SBOM. What is the most effective use of the SBOM in this situation?

Submit the SBOM to the library maintainer for analysis.

Rebuild the image without any changes and hope the vulnerability is not exploitable.

Delete the SBOM to avoid confusion and rely on the vulnerability scanner.

Cross-reference the SBOM with the vulnerability database to determine if the affected version is present.

How does an SBOM help in identifying vulnerabilities in a software product?

By listing all components with their versions, allowing correlation with vulnerability databases

By scanning the runtime behavior of the application

By automatically patching vulnerable components

By encrypting the software to prevent tampering

How can an SBOM be used to track vulnerabilities in a deployed application?

By comparing the SBOM against vulnerability databases to identify affected components

By running the SBOM as an executable to patch the system

By encrypting the application with the SBOM

By using the SBOM to configure network policies

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 2

Understand Your Supply Chain (e.g. SBOM, CI/CD, Artifact Repositories) CKS Practice Questions (Page 5)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

20%of the exam

Questions 21–25

21foundation · easy
Why should artifact repositories be scanned for vulnerabilities?
Select an answer first
22application · medium
Your organization builds a container image from a base image that includes a popular open-source library. During a security review, you need to quickly identify all third-party components and their versions in the final image to assess exposure to a newly disclosed vulnerability. Which approach best achieves this?
Select an answer first
23application · medium
You have an SBOM for a container image that is about to be deployed. A new critical vulnerability is disclosed in a library that is listed in the SBOM. What is the most effective use of the SBOM in this situation?
Select an answer first
24foundation · easy
How does an SBOM help in identifying vulnerabilities in a software product?
Select an answer first
25foundation · easy
How can an SBOM be used to track vulnerabilities in a deployed application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.