Linux Foundation CKS Exam - Topic 6 Question 86 Discussion

Actual exam question for Linux Foundation's CKS exam

Question #: 86
Topic #: 6

A container image scanner is set up on the cluster.

Given an incomplete configuration in the directory

/etc/kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://test-server.local.8081/image_policy

1. Enable the admission plugin.

2. Validate the control configuration and change it to implicit deny.

Finally, test the configuration by deploying the pod having the image tag as latest.

AExplanation:
ssh-add ~/.ssh/tempprivate
eval '$(ssh-agent -s)'
cd contrib/terraform/aws
vi terraform.tfvars
terraform init
terraform apply -var-file=credentials.tfvars
ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_ssh_user=core -e bootstrap_os=coreos -b --become-user=root --flush-cache -e ansible_user=core

Show Suggested Answer

Suggested Answer: A

by Marshall at Nov 25, 2025, 03:13 PM

Limited Time Offer

25%

Off

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Milly

15 days ago

Testing with the latest image tag is a good final step.

upvoted 0 times

...

Cordelia

20 days ago

I’d go with the ssh-add command first.

upvoted 0 times

...

Lauran

25 days ago

Implicit deny makes sense for security.

upvoted 0 times

...

Candra

1 month ago

Yeah, but validating the control config is crucial too.

upvoted 0 times

...

Lizette

1 month ago

I think enabling the admission plugin is key.

upvoted 0 times

...

Ashley

1 month ago

This question is tricky. I feel a bit lost.

upvoted 0 times

...

Marcelle

2 months ago

I thought we were supposed to allow specific images, not deny everything?

upvoted 0 times

...

Hoa

2 months ago

Implicit deny is a must for better control!

upvoted 0 times

...

Mignon

2 months ago

Wait, why are we using the latest tag? Isn't that risky?

upvoted 0 times

...

Xochitl

2 months ago

Totally agree, that’s crucial for security.

upvoted 0 times

...

Marjory

3 months ago

Make sure to check the image policy endpoint!

upvoted 0 times

...

Roselle

3 months ago

Haha, the "ssh-add" and "eval" commands have nothing to do with this question. That's just a random set of commands.

upvoted 0 times

...

Reita

3 months ago

The image looks like it's related to the question, but I'm not sure how it fits in.

upvoted 0 times

...

Maurine

3 months ago

The steps mentioned in the question seem logical, but I'm not sure if that's the complete answer.

upvoted 0 times

...

Daryl

3 months ago

The question seems straightforward, but I'm not sure about the correct answer.

upvoted 0 times

...

Sunshine

4 months ago

I definitely remember the HTTPS endpoint part, but I’m not clear on how to connect it with the admission plugin settings.

upvoted 0 times

...

Francis

4 months ago

I feel like the testing part with the pod deployment is crucial, but I’m a bit confused about how the image tag affects the admission control.

upvoted 0 times

...

Edison

4 months ago

I think we had a similar question about validating configurations, but I can’t recall the exact steps to change it to implicit deny.

upvoted 0 times

...

Theron

4 months ago

I remember we practiced enabling the admission plugin, but I’m not sure if it was for a scanner or something else.

upvoted 0 times

...

Sheridan

4 months ago

This is a lot of information to process. I'm a bit confused about the whole container image scanner and HTTPS endpoint. I'll need to make sure I understand those concepts before I can really tackle this question.

upvoted 0 times

...

Colton

4 months ago

I think I've got a handle on this. First, I'll enable the admission plugin. Then I'll validate the control configuration and change it to implicit deny. Finally, I'll test the configuration by deploying a pod with the latest image tag. I feel pretty confident I can tackle this question.

upvoted 0 times

...

Tamesha

5 months ago

Hmm, this is a bit complex. I'll need to make sure I understand the container image scanner and how to test the configuration by deploying a pod with the latest image tag. I might have to do some research on that.

upvoted 0 times

...

Lawrence

5 months ago

Okay, let's see. First, I need to enable the admission plugin. That seems straightforward enough. Then I have to validate the control configuration and change it to implicit deny. I'm not sure exactly what that means, but I'll have to look into it.

upvoted 0 times

...