easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A small business uses Puppet for configuration…
A small business uses Puppet for configuration management on Linux servers. They are now migrating to containers and want to maintain security. The operations team is unfamiliar with containers. The security team insists on automated vulnerability scanning of container images before deployment. What should be the company's first step?
⚠ Common exam trap
Watch out — candidates often confuse the immediate security requirement (vulnerability scanning) with broader orchestration or training needs, leading them to choose a later-stage activity (like deploying Kubernetes or training) instead of the foundational step of establishing a secure image pipeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a hardened base image standard, and set up a CI pipeline that automatically scans every image for vulnerabilities before it is pushed to the registry.
The first step in securing container images is to establish a hardened base image standard and integrate vulnerability scanning into a CI pipeline. This ensures that every image is automatically checked for known vulnerabilities before being pushed to the registry, addressing the security team's requirement without requiring the operations team to immediately master container orchestration. This approach aligns with the principle of shifting security left, preventing vulnerable images from ever reaching production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a Kubernetes cluster and migrate all applications.
Why it's wrong here
Deploying a Kubernetes cluster introduces significant orchestration complexity that the operations team, unfamiliar with containers, cannot manage, and it does not perform automated vulnerability scanning of container images before deployment. This option is tempting because Kubernetes is the standard platform for container orchestration at scale, and it would be the correct first step if the primary goal were to schedule and manage containerised workloads after a scanning pipeline had already been established.
- ✗
Discontinue using Puppet and switch entirely to container-based configurations.
Why it's wrong here
Puppet can coexist with containers for host management; abandoning it is not necessary.
- ✗
Train the operations team on Docker and Kubernetes fundamentals.
Why it's wrong here
Training is important but not the first step; policy and process should precede training.
- ✓
Create a hardened base image standard, and set up a CI pipeline that automatically scans every image for vulnerabilities before it is pushed to the registry.
Why this is correct
This establishes security controls early and automates the scanning requirement.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.