hardMultiple ChoiceObjective-mapped
Automated Vulnerability Scanning in CI/CD Pipeline for Container Images
In a CI/CD pipeline, a container image is built from a Dockerfile that uses a base image from a public registry. To minimize the attack surface, which of the following actions should be automated in the pipeline?
Quick Answer
The answer is to run a vulnerability scanner and fail the build on critical findings. This is correct because automated vulnerability scanning in the CI/CD pipeline for container images acts as a security gate, preventing images with known exploitable flaws from progressing to production. By failing the build on critical findings, you enforce a policy that stops vulnerable code from being deployed, directly reducing the attack surface and aligning with secure software supply chain management. On the CompTIA SecurityX CAS-004 exam, this concept tests your understanding of DevSecOps integration and container security controls; a common trap is choosing to only log findings without failing the build, which does not block the vulnerability. Remember the mnemonic “Fail Fast, Fix First” — if a scan finds a critical flaw, the pipeline must stop immediately to protect the runtime environment.
⚠ Common exam trap
CompTIA often tests the misconception that using the 'latest' tag is a safe practice for security patching, when in fact it undermines deterministic builds and introduces supply chain risks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run a vulnerability scanner and fail the build on critical findings
Integrating a vulnerability scanner into the CI/CD pipeline and failing the build on critical findings directly reduces the attack surface by preventing deployment of images with known exploitable vulnerabilities. This aligns with the principle of secure software supply chain management, where automated security gates are essential for containerized environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'latest' tag for the base image to get latest patches
Why it's wrong here
'latest' can introduce breaking changes or untested versions.
- ✗
Store the Dockerfile in a private repository only
Why it's wrong here
Storage location does not reduce attack surface.
- ✗
Install all available packages inside the container
Why it's wrong here
Installing extra packages increases attack surface.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CAS-005 exam frequently reuses these exact scenarios with slightly different constraints.
✓Run a vulnerability scanner and fail the build on critical findingsCorrect answer▾
✗Use the 'latest' tag for the base image to get latest patchesWrong answer — click to see why▾
Why this is wrong here
'latest' can introduce breaking changes or untested versions.
✗Store the Dockerfile in a private repository onlyWrong answer — click to see why▾
Why this is wrong here
Storage location does not reduce attack surface.
✗Install all available packages inside the containerWrong answer — click to see why▾
Why this is wrong here
Installing extra packages increases attack surface.
Analysis generated from the official CAS-005blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A small business uses Puppet for configuration management on Linux servers. They are now migrating to containers and want to maintain security. The operations team is unfamiliar with containers. The security team insists on automated vulnerability scanning of container images before deployment. What should be the company's first step?
easy- A.Deploy a Kubernetes cluster and migrate all applications.
- B.Discontinue using Puppet and switch entirely to container-based configurations.
- C.Train the operations team on Docker and Kubernetes fundamentals.
- ✓ D.Create a hardened base image standard, and set up a CI pipeline that automatically scans every image for vulnerabilities before it is pushed to the registry.
Why D: The first step in securing container images is to establish a hardened base image standard and integrate vulnerability scanning into a CI pipeline. This ensures that every image is automatically checked for known vulnerabilities before being pushed to the registry, addressing the security team's requirement without requiring the operations team to immediately master container orchestration. This approach aligns with the principle of shifting security left, preventing vulnerable images from ever reaching production.
Variation 2. Which two practices are essential for securing a CI/CD pipeline? (Choose two.)
easy- A.Allow any developer to merge code into the main branch without review.
- ✓ B.Implement code signing for all build artifacts.
- C.Store credentials in plaintext within pipeline configuration files.
- D.Use immutable tags for container images.
- ✓ E.Scan container images for vulnerabilities before deployment.
Why B: Code signing ensures the integrity and authenticity of build artifacts, preventing tampering or injection of malicious code during the CI/CD pipeline. This practice verifies that artifacts originate from a trusted source and have not been altered, which is critical for secure software supply chain management.
Variation 3. A development team is using Docker containers for microservices. The security team wants to scan containers for vulnerabilities during the CI/CD pipeline. Which approach is most effective?
medium- A.Use a runtime security tool that scans containers only when they are running.
- B.Scan the container image only after deployment to production.
- C.Rely on the developers to manually check for vulnerabilities.
- ✓ D.Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.
Why D: Integrating image scanning into the CI/CD pipeline before promoting images to the registry ensures vulnerabilities are detected early, preventing insecure images from being deployed. Tools like Trivy scan container layers against known vulnerability databases (e.g., CVE databases) at build time, aligning with DevSecOps principles of shifting security left. This approach is more effective than runtime-only scanning or post-deployment checks, as it stops vulnerable images from reaching production.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.