Linux Foundation CKS Exam - Topic 6 Question 86 Discussion

Actual exam question for Linux Foundation's CKS exam

Question #: 86
Topic #: 6

[All CKS Questions]

A container image scanner is set up on the cluster.

Given an incomplete configuration in the directory

/etc/kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://test-server.local.8081/image_policy

1. Enable the admission plugin.

2. Validate the control configuration and change it to implicit deny.

Finally, test the configuration by deploying the pod having the image tag as latest.

AExplanation:
ssh-add ~/.ssh/tempprivate
eval '$(ssh-agent -s)'
cd contrib/terraform/aws
vi terraform.tfvars
terraform init
terraform apply -var-file=credentials.tfvars
ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_ssh_user=core -e bootstrap_os=coreos -b --become-user=root --flush-cache -e ansible_user=core

Show Suggested Answer

Suggested Answer: A

by Marshall at Nov 25, 2025, 03:13 PM

Limited Time Offer

25%

Off

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marcelle

10 hours ago

I thought we were supposed to allow specific images, not deny everything?

upvoted 0 times

...

Hoa

5 days ago

Implicit deny is a must for better control!

upvoted 0 times

...

Mignon

24 days ago

Wait, why are we using the latest tag? Isn't that risky?

upvoted 0 times

...

Xochitl

29 days ago

Totally agree, that’s crucial for security.

upvoted 0 times

...

Marjory

1 month ago

Make sure to check the image policy endpoint!

upvoted 0 times

...

Roselle

1 month ago

Haha, the "ssh-add" and "eval" commands have nothing to do with this question. That's just a random set of commands.

upvoted 0 times

...

Reita

1 month ago

The image looks like it's related to the question, but I'm not sure how it fits in.

upvoted 0 times

...

Maurine

2 months ago

The steps mentioned in the question seem logical, but I'm not sure if that's the complete answer.

upvoted 0 times

...

Daryl

2 months ago

The question seems straightforward, but I'm not sure about the correct answer.

upvoted 0 times

...

Sunshine

2 months ago

I definitely remember the HTTPS endpoint part, but I’m not clear on how to connect it with the admission plugin settings.

upvoted 0 times

...

Francis

2 months ago

I feel like the testing part with the pod deployment is crucial, but I’m a bit confused about how the image tag affects the admission control.

upvoted 0 times

...

Edison

2 months ago

I think we had a similar question about validating configurations, but I can’t recall the exact steps to change it to implicit deny.

upvoted 0 times

...

Theron

3 months ago

I remember we practiced enabling the admission plugin, but I’m not sure if it was for a scanner or something else.

upvoted 0 times

...

Sheridan

3 months ago

This is a lot of information to process. I'm a bit confused about the whole container image scanner and HTTPS endpoint. I'll need to make sure I understand those concepts before I can really tackle this question.

upvoted 0 times

...

Colton

3 months ago

I think I've got a handle on this. First, I'll enable the admission plugin. Then I'll validate the control configuration and change it to implicit deny. Finally, I'll test the configuration by deploying a pod with the latest image tag. I feel pretty confident I can tackle this question.

upvoted 0 times

...

Tamesha

3 months ago

Hmm, this is a bit complex. I'll need to make sure I understand the container image scanner and how to test the configuration by deploying a pod with the latest image tag. I might have to do some research on that.

upvoted 0 times

...

Lawrence

4 months ago

Okay, let's see. First, I need to enable the admission plugin. That seems straightforward enough. Then I have to validate the control configuration and change it to implicit deny. I'm not sure exactly what that means, but I'll have to look into it.

upvoted 0 times

...