# A Kyverno verifyImages rule has mutateDigest: true. What does it do once the signature is verified?

Kyverno, Hard (Expert), Security. https://k8wiz.com/uquiz/a-kyverno-verifyimages-rule-has-mutatedigest-true-what-does-it-do-once-the-signature-is-verified

- A. Uploads the verified signature to the image registry
- B. Rejects images that are referenced by digest instead of tag
- C. Replaces the image tag in the pod spec with the verified digest
- D. Recomputes the digest and stores it in an annotation

**Answer:** Replaces the image tag in the pod spec with the verified digest

**Explanation:** A tag can be moved to point at a different image after verification. mutateDigest pins the pod to the exact digest Kyverno checked, so the node pulls the image that was verified. It is enabled by default.