ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using an admission-control mechanism that checks image signatures at deployment time is the most reliable way to ensure every pod executes only pre-approved, signed images. EKS supports integrating AWS Signer with Amazon ECR and deploying an admission controller (for example, an OPA Gatekeeper or AWS Signer-based webhook) that verifies the digital signature on the image manifest before the Kubernetes API server admits the pod. NetworkPolicies only control runtime traffic and do not validate image provenance. Restricting developers from pushing unsigned images reduces risk but cannot stop a manifest from referencing an unsigned image in another account or registry, and it does not provide enforcement at run time. Encrypting worker-node volumes protects data at rest but does nothing to ensure that only signed images are deployed. Therefore, the admission-controller-based signature validation is the most effective and comprehensive control.