mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A development team is using Docker containers for…
A development team is using Docker containers for microservices. The security team wants to scan containers for vulnerabilities during the CI/CD pipeline. Which approach is most effective?
⚠ Common exam trap
A common misconception is that runtime security scanning is sufficient for vulnerability management. However, runtime tools detect active threats but not static vulnerabilities in image layers, which must be caught earlier in the pipeline via image scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.
Integrating image scanning into the CI/CD pipeline before promoting images to the registry ensures vulnerabilities are detected early, preventing insecure images from being deployed. Tools like Trivy scan container layers against known vulnerability databases (e.g., CVE databases) at build time, aligning with DevSecOps principles of shifting security left. This approach is more effective than runtime-only scanning or post-deployment checks, as it stops vulnerable images from reaching production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a runtime security tool that scans containers only when they are running.
Why it's wrong here
Runtime scanning does not catch build-time vulnerabilities.
- ✗
Scan the container image only after deployment to production.
Why it's wrong here
Scanning after deployment allows vulnerabilities to reach production.
- ✗
Rely on the developers to manually check for vulnerabilities.
Why it's wrong here
Manual checks are inconsistent and error-prone.
- ✓
Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.
Why this is correct
Early scanning prevents vulnerable images from being stored or deployed.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.