Cluster: scanner Master node: controlplane Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context scanner Given…

This task tests your ability to use Trivy to scan container images running in a Kubernetes namespace for High/Critical CVEs, then remediate by deleting the vulnerable Pods.

Submitted by daniela_cl· May 5, 2026Runtime Security

Question

Cluster: scanner
Master node: controlplane
Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context scanner
Given:
You may use Trivy's documentation.
Task:
Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.
Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images.
Trivy is pre-installed on the cluster's master node. Use cluster's master node to use Trivy.

Explanation

This task tests your ability to use Trivy to scan container images running in a Kubernetes namespace for High/Critical CVEs, then remediate by deleting the vulnerable Pods.

Approach. First, switch context with kubectl config use-context scanner, then SSH to the master node (controlplane). Run kubectl get pods -n nato -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' to list all images used in the nato namespace. For each image, run trivy image --severity HIGH,CRITICAL <image-name> on the master node. Any image that returns findings at HIGH or CRITICAL severity means the Pod using it must be deleted with kubectl delete pod <pod-name> -n nato. Repeat for all Pods until only clean images remain in the namespace.

Concept tested. Container image vulnerability scanning with Trivy in a Kubernetes cluster - specifically identifying running workloads with HIGH/CRITICAL CVEs and performing remediation by removing the offending Pods. This is a core CKS (Certified Kubernetes Security Specialist) skill covering supply chain security and runtime risk reduction.

Reference. https://aquasecurity.github.io/trivy/latest/docs/target/container_image/

Topics

#Trivy#Vulnerability Scanning#Container Image Security#Kubernetes Pod Management

Community Discussion

No community discussion yet for this question.

Full CKS Practice