hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is migrating its on-premises monolithic…
An organization is migrating its on-premises monolithic application to a containerized microservices architecture on a Kubernetes cluster. The development team has created a set of Docker images that are stored in a private registry. The security team requires that all container images be scanned for vulnerabilities before deployment. The current CI/CD pipeline uses Jenkins to build images, push them to the registry, and then deploy to Kubernetes via kubectl. The scanning is performed by a tool that generates a report, but developers have been ignoring critical vulnerabilities and deploying anyway. The security team wants to enforce a policy that blocks deployment if the image has any critical or high-severity vulnerabilities. Additionally, the cluster must ensure that containers run with the least privilege and that secrets are not exposed in environment variables. The operations team is concerned about performance overhead from runtime security monitoring.
Which of the following approaches best addresses these requirements while minimizing operational overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement admission controller webhooks that check vulnerability scan results from the registry before allowing pod creation, and use a service mesh with mutual TLS to encrypt secrets.
Admission controller webhooks can enforce vulnerability policies at deployment time, blocking pods with critical/high vulnerabilities without runtime overhead. Service mesh with mTLS encrypts secrets in transit, reducing exposure. Option B is incorrect because aborting the Jenkins build does not prevent deployment from other sources (e.g., direct kubectl) and secrets mounted as volumes are still vulnerable to compromise. Option C is incorrect because runtime security agents incur performance overhead and do not block deployment upfront; they monitor activity but don't prevent vulnerable images from being scheduled. Option D is incorrect because network policies do not address vulnerability scanning or secret protection; they only control pod-to-pod communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement admission controller webhooks that check vulnerability scan results from the registry before allowing pod creation, and use a service mesh with mutual TLS to encrypt secrets.
Why this is correct
Admission controller webhooks can enforce vulnerability policies at deployment time, blocking pods with critical/high vulnerabilities without runtime overhead. Service mesh with mTLS encrypts secrets in transit, reducing exposure.
- ✗
Use a custom script in Jenkins to parse the scan report and abort the build if vulnerabilities are found, and store secrets in Kubernetes secrets mounted as volumes.
Why it's wrong here
Aborting the Jenkins build does not prevent deployment from other sources (e.g., direct kubectl) and secrets mounted as volumes are still vulnerable to compromise.
- ✗
Deploy a runtime security agent that monitors container activity and rejects pods that contain known vulnerability signatures, and use Kubernetes RBAC to limit permissions.
Why it's wrong here
Runtime security agents incur performance overhead and do not block deployment upfront; they monitor activity but don't prevent vulnerable images from being scheduled.
- ✗
Configure a network policy in Kubernetes to restrict pod-to-pod communication, and use a static analysis tool during development to find coding flaws.
Why it's wrong here
Network policies do not address vulnerability scanning or secret protection; they only control pod-to-pod communication.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.