Courseiva
← 200-901
Full test
mediumMultiple ChoiceObjective-mapped

200-901 Practice Question: During a CI/CD pipeline, a security scan reveals…

During a CI/CD pipeline, a security scan reveals that a Docker image contains a vulnerability in a base layer. Which action BEST addresses the issue?

⚠ Common exam trap

Cisco often tests the distinction between detection/monitoring (options C and D) and actual remediation (option B), trapping candidates who think run-time monitoring or ignoring the report is sufficient to address a build-time vulnerability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Rebuild the image using an updated base image from a trusted registry.

The vulnerability exists in the base layer of the Docker image, which is immutable once built. The only way to eliminate the vulnerability is to rebuild the image using an updated base image from a trusted registry (e.g., Docker Hub official images or a private registry with patched images). This ensures the vulnerable packages are replaced with patched versions at the OS or application level, directly addressing the root cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Disable the security scanner to avoid false positives.

    Why it's wrong here

    Ignoring vulnerabilities is not a security best practice.

  • ✓

    Rebuild the image using an updated base image from a trusted registry.

    Why this is correct

    Fixes the vulnerability by updating the base image.

  • ✗

    Implement run-time security monitoring to detect exploitation.

    Why it's wrong here

    Monitors but does not remove the vulnerability.

  • ✗

    Add an exception to the vulnerability report.

    Why it's wrong here

    Does not address the underlying vulnerability.

About these practice questions

One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.