mediumMultiple ChoiceObjective-mapped
200-901 Practice Question: A security team wants to ensure that only signed…
A security team wants to ensure that only signed Docker images are deployed in production. Which CI/CD pipeline step validates the image signature before deployment?
⚠ Common exam trap
Candidates often confuse integrity verification (hash comparison) with authenticity verification (digital signatures), assuming a simple SHA check provides the same security as a full PKI-based signing scheme like Docker Content Trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Docker Content Trust with Notary to verify signatures.
Docker Content Trust (DCT) integrates with Notary to provide a framework for signing and verifying Docker images. When DCT is enabled in the CI/CD pipeline, the Docker client verifies the image's signature against a trusted signing key before allowing the image to be pulled or deployed, ensuring only images signed by authorized parties are used in production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Docker Content Trust with Notary to verify signatures.
Why this is correct
Standard mechanism for image signing and verification.
- ✗
Compare the image SHA with a known good hash.
Why it's wrong here
Possible but less integrated than Docker Content Trust.
- ✗
Run a vulnerability scan on the image.
Why it's wrong here
Scans for vulnerabilities, not signatures.
- ✗
Check the image size on registry.
Why it's wrong here
Image size does not indicate authenticity.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.