hardMultiple Choice
200-901 Practice Question: Refer to the exhibit
Network Topology
Refer to the exhibit. What is the most effective action to eliminate both vulnerabilities in the container image?
⚠ Common exam trap
Cisco often tests the misconception that updating packages (Option A) is sufficient, when the real goal is to eliminate the vulnerable components entirely, not just patch them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch the base image to a distroless base image that does not include openssl and curl.
Switching to a distroless base image removes unnecessary packages like openssl and curl entirely, eliminating the vulnerabilities they introduce. Distroless images contain only the application and its runtime dependencies, reducing the attack surface by excluding OS package managers and shell utilities that are common sources of CVEs. This approach directly addresses both vulnerabilities by ensuring the vulnerable components are not present in the image at all.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rebuild the image using the same base image but update the OS packages.
Why it's wrong here
Patching OS packages only clears vulnerabilities originating from the base image's operating system layer; any flaws in application dependencies or bundled libraries remain. This is the right action when the exhibit shows only OS-level CVEs, but it cannot eliminate both findings when one sits in an application package.
- ✗
Add a .dockerignore file to exclude vulnerable libraries.
Why it's wrong here
A .dockerignore file excludes files from the build context before the image is built; it cannot remove libraries already installed by package managers inside layers. It is the correct tool for keeping secrets, test data, or large artefacts out of an image, not for remediating CVEs in installed dependencies.
- ✗
Only run the container with read-only root filesystem.
Why it's wrong here
A read-only root filesystem restricts runtime writes to the container, mitigating post-exploitation persistence, but the vulnerable code still ships and executes. It is the right hardening control when the requirement is limiting runtime tampering, not when the goal is removing vulnerable packages from the image itself.
- ✓
Switch the base image to a distroless base image that does not include openssl and curl.
Why this is correct
Distroless images contain only the application and its runtime dependencies, omitting package managers and shells. Removing openssl and curl eliminates the vulnerable libraries entirely, so both CVEs disappear rather than being patched or masked, satisfying the requirement to eliminate both vulnerabilities.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.