Exam
CKS
Home › CKS practice tasks › Identify a Vulnerable Package and Generate an SPDX SBOM
CKS · Supply Chain Security
Identify a Vulnerable Package and Generate an SPDX SBOM
The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image.
🗓️ Free Task of the Week: one CKS task is unlocked free for everyone every week - no card, real cluster, auto-graded (2 tries/week). Create a free account and check whether this one is live now.
The task
Task
The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image.
First, find out which version of the alpine image contains the libcrypto3 package at version 3.1.4-r5.
Next, use the pre-installed bom tool to create an SPDX document for the identified image version at /home/candidate/alpine.spdx.
> You can find the bom tool documentation with bom --help.
What this tests
Scan images for vulnerabilities, harden Dockerfiles, generate SBOMs, and enforce image policy. On the CKS exam, Supply Chain Security tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.
Practice it for real
prepium.sh drops you into your own isolated Kubernetes cluster in the browser - no install, no credit card. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). The canonical solution unlocks after you attempt it, so you learn the fast, exam-ready way to do it.