mediumMultiple Choice
CAS-004 Practice Question: A development team is using Docker containers for…
A development team is using Docker containers for microservices. The security team wants to scan containers for vulnerabilities during the CI/CD pipeline. Which approach is most effective?
⚠ Common exam trap
A common misconception is that runtime security scanning is sufficient for vulnerability management. However, runtime tools detect active threats but not static vulnerabilities in image layers, which must be caught earlier in the pipeline via image scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.
Integrating image scanning into the CI/CD pipeline before promoting images to the registry ensures vulnerabilities are detected early, preventing insecure images from being deployed. Tools like Trivy scan container layers against known vulnerability databases (e.g., CVE databases) at build time, aligning with DevSecOps principles of shifting security left. This approach is more effective than runtime-only scanning or post-deployment checks, as it stops vulnerable images from reaching production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a runtime security tool that scans containers only when they are running.
Why it's wrong here
Runtime scanning detects vulnerabilities only after deployment, leaving images with known flaws to reach production. Runtime tooling is tempting because it also catches live threats and drift, and it would be the right layer for behavioural detection rather than pre-deployment image scanning.
- ✗
Scan the container image only after deployment to production.
Why it's wrong here
Scanning after production deployment detects vulnerabilities only once exploitable workloads are live, leaving no gate before release. It is tempting because runtime scanning catches issues in the deployed configuration, and it would be correct for continuous monitoring of running containers rather than pipeline gating.
- ✗
Rely on the developers to manually check for vulnerabilities.
Why it's wrong here
Manual checking cannot scale to every image build and depends on human diligence, so vulnerabilities reach the registry undetected. It is tempting because developers already review code and dependencies informally, and manual review would suit one-off audits of a small, static image set where no pipeline automation exists.
- ✓
Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.
Why this is correct
Scanning images in the pipeline before they reach the registry blocks vulnerable artefacts from ever being stored or deployed, satisfying the CI/CD constraint by shifting detection left rather than scanning after promotion, when remediation requires rebuilding and republishing.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.