mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A company uses a CI/CD pipeline with Jenkins to…
A company uses a CI/CD pipeline with Jenkins to build and deploy containerized applications. Security scanning of container images is currently done manually after deployment, causing delays. Which of the following would be the most effective automation to improve security and efficiency?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.
Integrating container image scanning into the CI/CD pipeline ensures vulnerabilities are detected before deployment, reducing delays and improving security. Option A is correct because adding a stage in Jenkins to run Trivy scans before pushing images to the registry catches issues early. Option B is incorrect because weekly scans after deployment do not prevent vulnerable images from being deployed. Option C is incorrect because Terraform can enforce registry trust but does not scan for vulnerabilities within the image. Option D is incorrect because relying on developers for local scans is inconsistent and not automated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a stage to the Jenkins pipeline that runs container image scanning using Trivy before pushing to the registry.
Why this is correct
Automated scanning in the pipeline catches vulnerabilities before deployment, enforcing security earlier.
- ✗
Schedule a weekly cron job to scan the container registry and generate reports.
Why it's wrong here
Delayed scanning allows vulnerabilities to be deployed before detection.
- ✗
Use Terraform to enforce that only images from a trusted registry are deployed.
Why it's wrong here
Terraform controls infrastructure provisioning but does not replace image scanning.
- ✗
Require developers to scan images locally using a Dockerfile HEALTHCHECK instruction.
Why it's wrong here
HEALTHCHECK is for runtime health, not vulnerability scanning, and relies on manual effort.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.