mediumMultiple ChoiceObjective-mapped
CAS-004 CI/CD Pipeline Security Scanning Practice Question
A company uses a microservices architecture with Docker containers orchestrated by Kubernetes. Developers push code to a Git repository, which triggers a CI/CD pipeline using Jenkins. The pipeline builds Docker images and pushes them to a private registry (Harbor). Recently, a critical vulnerability (CVE-2024-XXXX) was discovered in the base image of several containers. The security team wants to ensure that only images that pass vulnerability scans are deployed to production. The pipeline currently builds and pushes images without any security check. Developers are responsible for updating base images, but this has been inconsistent. Which action should the security team take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Jenkins to run Trivy scans on each built image and fail the pipeline if vulnerabilities exceed a defined threshold, and only allow images that pass to be pushed to the production registry
It integrates vulnerability scanning directly into the CI/CD pipeline. By running Trivy as a step after the image is built but before it is pushed to the production registry, the pipeline can fail if the vulnerability count or severity exceeds a defined threshold. This ensures that only images that pass the security scan are deployed to production. Option A (manual updates) is unreliable and does not enforce policy. Option B (Harbor webhook) would block pulls but does not prevent the push of vulnerable images; the image would already be in the registry. Option D (PodSecurity admission) controls what runs in Kubernetes but does not assess vulnerability severity and operates too late; the image would already be built and pushed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require developers to manually check their images and update base images
Why it's wrong here
Manual processes are inconsistent and not enforceable.
- ✗
Implement a webhook in Harbor to automatically scan all images upon push and block vulnerable images from being pulled
Why it's wrong here
Scanning after push allows vulnerable images into the registry; blocking pulls may still leave images present.
- ✓
Configure Jenkins to run Trivy scans on each built image and fail the pipeline if vulnerabilities exceed a defined threshold, and only allow images that pass to be pushed to the production registry
Why this is correct
This integrates security into the CI/CD pipeline, ensuring only compliant images are deployed.
- ✗
Use Kubernetes PodSecurity admission to block containers with high-severity vulnerabilities
Why it's wrong here
PodSecurity does not evaluate vulnerability scores; it enforces pod-level security contexts.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.