easyMultiple SelectObjective-mapped
CAS-004 Practice Question: A security analyst is reviewing a CI/CD pipeline…
A security analyst is reviewing a CI/CD pipeline configuration. The pipeline uses a containerized application and includes automated security scanning. Which TWO practices should be implemented to ensure container immutability and reduce the attack surface?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run containers with read-only root filesystem.
Running containers with a read-only root filesystem enforces immutability, preventing any modifications at runtime. Option B is correct because scanning images for vulnerabilities at build time reduces the attack surface by catching issues before deployment. Option C is incorrect because using the same base image for all environments does not directly relate to immutability or attack surface reduction and may ignore environment-specific security needs. Option D is incorrect because running containers as root weakens security and increases the attack surface. Option E is incorrect because storing credentials in environment variables is insecure and should be avoided.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run containers with read-only root filesystem.
Why this is correct
Enforces container immutability by preventing modifications at runtime.
- ✓
Scan images for vulnerabilities at build time.
Why this is correct
Reduces attack surface by identifying vulnerabilities before deployment.
- ✗
Use the same base image for all environments.
Why it's wrong here
Using the same base image does not enforce immutability and may introduce environment mismatches.
- ✗
Run containers as root.
Why it's wrong here
Running as root increases the attack surface and violates least privilege.
- ✗
Store credentials in environment variables.
Why it's wrong here
Environment variables can leak secrets; better to use a secrets manager.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.