hardMultiple ChoiceObjective-mapped
200-901 Practice Question: Refer to the exhibit
Network Topology
Refer to the exhibit. What is the most effective action to eliminate both vulnerabilities in the container image?
⚠ Common exam trap
Cisco often tests the misconception that updating packages (Option A) is sufficient, when the real goal is to eliminate the vulnerable components entirely, not just patch them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch the base image to a distroless base image that does not include openssl and curl.
Switching to a distroless base image removes unnecessary packages like openssl and curl entirely, eliminating the vulnerabilities they introduce. Distroless images contain only the application and its runtime dependencies, reducing the attack surface by excluding OS package managers and shell utilities that are common sources of CVEs. This approach directly addresses both vulnerabilities by ensuring the vulnerable components are not present in the image at all.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rebuild the image using the same base image but update the OS packages.
Why it's wrong here
May not fully eliminate if the base image still contains the vulnerable libraries.
- ✗
Add a .dockerignore file to exclude vulnerable libraries.
Why it's wrong here
Does not affect the base image contents.
- ✗
Only run the container with read-only root filesystem.
Why it's wrong here
Does not remove vulnerabilities.
- ✓
Switch the base image to a distroless base image that does not include openssl and curl.
Why this is correct
Removes these libraries entirely, as they are not needed by the application.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.