Kubernetes Supply Chain Security Quiz

1. Which tool can generate and verify SBOMs for container images?

Syft

Kube-apiserver

Containerd

Flannel

2. True or False: A container image can be trusted if it passes vulnerability scans at build time.

True

False

3. Which of the following best describes supply chain security in Kubernetes?

Securing every step from code commit to container runtime execution

Only securing the network between services

Protecting only the master node components

Encrypting storage volumes only

4. What is a critical vulnerability in the context of container image scanning?

A flaw with a high CVSS score that could lead to system compromise

Any deprecated package in the image

A missing optional dependency

An outdated documentation file

5. True or False: Container runtime security is less important than image scanning in supply chain protection.

True

False

6. Which policy prevents the use of container images with the 'latest' tag in production?

ImagePolicyWebhook or custom admission controller

NetworkPolicy

IngressPolicy

ServicePolicy

7. What is the benefit of using image signing and verification in a Kubernetes environment?

Ensures images come from trusted sources and prevents tampering

Automatically fixes all security vulnerabilities

Reduces the size of container images

Increases network bandwidth for image pulls

8. True or False: Regularly updating base images is unnecessary if the application code is secure.

True

False

9. Which admission controller can enforce pod security standards and restrict privileged containers?

PodSecurityStandards

ServiceAccount

RBAC

NetworkPolicy

10. What does the principle of 'immutable images' mean in Kubernetes security?

Container images must not be modified after deployment

Images can only be deleted by administrators

Images must be stored in read-only filesystems

Images cannot be pushed to any registry

11. True or False: Image scanning should only be performed on base images, not application layers.

True

False

12. Which tool is commonly used to scan container images for known vulnerabilities before deployment?

Trivy

Kubelet

Etcd

Kube-proxy

13. What is a Software Bill of Materials (SBOM) and why is it important for supply chain security?

A detailed inventory of all components in an image; helps identify vulnerabilities

A billing document for container storage costs

A deployment schedule for Kubernetes clusters

A list of running pods in a namespace

14. Which Kubernetes feature allows you to prevent the execution of unsigned or unapproved images?

ValidatingWebhookConfiguration

NetworkPolicy

ServiceAccount

ConfigMap

15. True or False: Using the 'latest' tag for container images in production is a recommended security practice.

True

False

16. What is the purpose of a private container registry in supply chain security?

To control access to images and audit pull events

To increase image download speed

To reduce storage costs

To automatically patch vulnerabilities

17. Which of the following is a best practice for managing secrets in a Kubernetes supply chain?

Store secrets in environment variables within Dockerfiles

Use external secret management systems and reference them at runtime

Embed secrets directly in container images

Pass secrets as command-line arguments

18. What does a digital signature on a container image verify?

The image has not been tampered with and comes from a trusted source

The image will run without errors

The image contains no secrets

The image is compressed efficiently

19. True or False: Container images should be scanned for vulnerabilities only once at build time.

True

False

20. Which admission controller can enforce that container images must come from approved registries only?

PodSecurityPolicy

ImagePolicyWebhook

ResourceQuota

LimitRanger

21. What is the primary purpose of an image admission controller in Kubernetes?

Validate and enforce image source and security policies

Automatically restart failed pods

Monitor network traffic between pods

Manage persistent volume claims

CKS Kubernetes Supply Chain Security Quiz

1. Which tool can generate and verify SBOMs for container images?

2.

What first name or nickname would you like us to use?

2. True or False: A container image can be trusted if it passes vulnerability scans at build time.

3. Which of the following best describes supply chain security in Kubernetes?

4. What is a critical vulnerability in the context of container image scanning?

5. True or False: Container runtime security is less important than image scanning in supply chain protection.

6. Which policy prevents the use of container images with the 'latest' tag in production?

7. What is the benefit of using image signing and verification in a Kubernetes environment?

8. True or False: Regularly updating base images is unnecessary if the application code is secure.

9. Which admission controller can enforce pod security standards and restrict privileged containers?

10. What does the principle of 'immutable images' mean in Kubernetes security?

11. True or False: Image scanning should only be performed on base images, not application layers.

12. Which tool is commonly used to scan container images for known vulnerabilities before deployment?

13. What is a Software Bill of Materials (SBOM) and why is it important for supply chain security?

14. Which Kubernetes feature allows you to prevent the execution of unsigned or unapproved images?

15. True or False: Using the 'latest' tag for container images in production is a recommended security practice.

16. What is the purpose of a private container registry in supply chain security?

17. Which of the following is a best practice for managing secrets in a Kubernetes supply chain?

18. What does a digital signature on a container image verify?

19. True or False: Container images should be scanned for vulnerabilities only once at build time.

20. Which admission controller can enforce that container images must come from approved registries only?

21. What is the primary purpose of an image admission controller in Kubernetes?