mediumMultiple Choice
CAS-004 Practice Question: A company uses a CI/CD pipeline with Jenkins to…
A company uses a CI/CD pipeline with Jenkins to build and deploy containerized applications. Security scanning of container images is currently done manually after deployment, causing delays. Which of the following would be the most effective automation to improve security and efficiency?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.
Integrating container image scanning into the CI/CD pipeline ensures vulnerabilities are detected before deployment, reducing delays and improving security. Option A is correct because adding a stage in Jenkins to run Trivy scans before pushing images to the registry catches issues early. Option B is incorrect because weekly scans after deployment do not prevent vulnerable images from being deployed. Option C is incorrect because Terraform can enforce registry trust but does not scan for vulnerabilities within the image. Option D is incorrect because relying on developers for local scans is inconsistent and not automated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.
Why this is correct
Trivy scanning as a pre-push Jenkins stage shifts detection left, failing the build before vulnerable images reach the registry. This satisfies the stem's automation and delay constraints, replacing manual post-deployment scanning with a gate that blocks flawed artefacts early.
- ✗
Schedule a weekly cron job to scan the container registry and generate reports.
Why it's wrong here
A weekly registry scan leaves images deployed for up to seven days before detection, so it does not shift scanning into the Jenkins build where failures can block promotion. Scheduled registry scanning suits periodic compliance reporting on already-published images, not gating each build before deployment.
- ✗
Use Terraform to enforce that only images from a trusted registry are deployed.
Why it's wrong here
Terraform restricts which registry supplies images; it inspects no layer contents, so vulnerable packages inside a trusted-registry image pass through. Registry allow-listing suits controlling provenance and supply-chain origin, not detecting CVEs, which requires scanning during the Jenkins build before deployment.
- ✗
Require developers to scan images locally using a Dockerfile HEALTHCHECK instruction.
Why it's wrong here
HEALTHCHECK defines container liveness probing at runtime; it performs no vulnerability scanning of image layers or packages. Local developer scanning also depends on manual discipline, not pipeline automation. HEALTHCHECK suits detecting hung application processes, not shifting security scanning left into the Jenkins build.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.