KCNA Cloud Native Application Delivery Practice Question
A CI pipeline scans container images for vulnerabilities. The scan report shows a critical vulnerability in a base image layer. What is the most efficient way to remediate this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the base image to a patched version and rebuild the application image
Rebuilding the image with an updated base image that includes the security fix is the standard approach to address base image vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Update the base image to a patched version and rebuild the application image
Why this is correct
Updating the base image and rebuilding ensures the vulnerability is removed from all layers.
- ✗
Use a runtime security tool to block exploitation
Why it's wrong here
A runtime security tool blocks exploitation of known vulnerabilities during execution, but the CI pipeline scan identifies the vulnerability in the base image layer before deployment. Remediation requires rebuilding the image with a patched base layer, not runtime mitigation. This option is tempting because runtime tools effectively prevent exploitation in production environments, where patching the image is impractical, making them correct for post-deployment defence.
- ✗
Apply a security patch directly to the running container
Why it's wrong here
Container images are immutable; patching a running container is not reproducible and not a best practice.
- ✗
Ignore the vulnerability if the application code is not affected
Why it's wrong here
Ignoring critical vulnerabilities is not recommended; they should be patched.
Go deeper
Related to this question
About these practice questions
Courseiva writes every KCNA question from scratch — 833 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are important security practices in a container image CI/CD pipeline?
medium- A.Hardcoding credentials in the image
- B.Running containers as root user
- ✓ C.Signing images to ensure integrity
- ✓ D.Using minimal base images to reduce attack surface
- ✓ E.Scanning images for vulnerabilities in the CI pipeline
Why C: Image scanning, signing, and using minimal base images are key security practices. Hardcoding credentials and running containers as root are anti-patterns.
Variation 2. What is the purpose of container image scanning in a CI/CD pipeline?
easy- A.To ensure the image is stored in a registry
- B.To measure the image size and optimize it
- C.To verify the image tag follows naming conventions
- ✓ D.To identify security vulnerabilities in the image
Why D: Container image scanning checks for known security vulnerabilities (e.g., CVEs) in the image layers and dependencies. This helps prevent deploying vulnerable containers into production. Option A is incorrect because storing in a registry is unrelated; scanning can occur before or after pushing. Option B is incorrect because image size and optimization are separate concerns, often handled by multi-stage builds or other tools. Option C is incorrect because naming conventions are typically enforced via policies or linting, not scanning. Option D correctly identifies the purpose of scanning: identifying security vulnerabilities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.