CAS-004 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Regular patching of running containers

  Why it's wrong here

  Patching running containers mutates live instances, directly contradicting immutability, which requires replacing containers with newly built images. It tempts because patching is standard hardening, but under immutable infrastructure you rebuild and redeploy images rather than modify running containers in place.

• ✓

  Image scanning and signing in the CI/CD pipeline

  Why this is correct

  Scanning detects vulnerabilities and embedded secrets, while signing produces a cryptographic attestation of image provenance. Enforcing signature verification at deploy time ensures only unaltered, approved images run, directly preserving the integrity guarantee that immutable infrastructure depends on.

• ✗

  Runtime security monitoring with seccomp

  Why it's wrong here

  Seccomp filters syscalls at runtime, so it constrains container behaviour but cannot verify that deployed images match their signed source, leaving tampering undetected. It is tempting because runtime monitoring genuinely hardens running workloads against exploitation; it would be the right control when the threat is container escape or privilege escalation, not image integrity.

• ✗

  Use of configuration management tools like Ansible

  Why it's wrong here

  Ansible converges mutable hosts toward a declared state, so drift is corrected in place rather than prevented; immutable infrastructure requires images to be built once, signed and never patched at runtime. It is tempting because configuration management genuinely enforces consistent server configuration, and would be correct for managing long-lived, mutable virtual machines.