mediumMultiple SelectObjective-mapped
CAS-004 Adopting container security best practices Practice Question
A company is adopting container security best practices. Which TWO actions should be implemented to reduce the attack surface of container images? (Select TWO.)
⚠ Common exam trap
Many exam-takers think disabling vulnerability scanning speeds up builds (C) without realizing it directly increases risk, or they may mistakenly believe environment variables are a secure way to handle secrets (D) when they are actually exposed in process listings and logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the container filesystem as read-only where possible.
Setting the container filesystem as read-only (A) reduces the attack surface by preventing attackers from writing malicious files or modifying system binaries within the container, even if they gain code execution. This enforces immutability and aligns with the principle of least privilege, as most containers do not need to write to their own filesystem at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the container filesystem as read-only where possible.
Why this is correct
A read-only filesystem prevents attackers from writing malicious files.
- ✓
Use signed images and verify signatures before deployment.
Why this is correct
Image signing prevents tampering and ensures only trusted images are used.
- ✗
Disable vulnerability scanning to optimize build time.
Why it's wrong here
Vulnerability scanning is essential for security; disabling it increases risk.
- ✗
Store secrets in environment variables.
Why it's wrong here
Secrets in env vars can be leaked; use secret management tools instead.
- ✗
Run containers with the root user to simplify permissions.
Why it's wrong here
Running as root increases the risk of container escape and privilege escalation.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.