Courseiva
mediumMultiple SelectObjective-mapped

CAS-004 Adopting container security best practices Practice Question

A company is adopting container security best practices. Which TWO actions should be implemented to reduce the attack surface of container images? (Select TWO.)

⚠ Common exam trap

Many exam-takers think disabling vulnerability scanning speeds up builds (C) without realizing it directly increases risk, or they may mistakenly believe environment variables are a secure way to handle secrets (D) when they are actually exposed in process listings and logs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Set the container filesystem as read-only where possible.

Setting the container filesystem as read-only (A) reduces the attack surface by preventing attackers from writing malicious files or modifying system binaries within the container, even if they gain code execution. This enforces immutability and aligns with the principle of least privilege, as most containers do not need to write to their own filesystem at runtime.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Set the container filesystem as read-only where possible.

    Why this is correct

    A read-only filesystem prevents attackers from writing malicious files.

  • Use signed images and verify signatures before deployment.

    Why this is correct

    Image signing prevents tampering and ensures only trusted images are used.

  • Disable vulnerability scanning to optimize build time.

    Why it's wrong here

    Vulnerability scanning is essential for security; disabling it increases risk.

  • Store secrets in environment variables.

    Why it's wrong here

    Secrets in env vars can be leaked; use secret management tools instead.

  • Run containers with the root user to simplify permissions.

    Why it's wrong here

    Running as root increases the risk of container escape and privilege escalation.

About these practice questions

One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.