mediumMultiple ChoiceObjective-mapped
CAS-004 Secure container scanning script Practice Question
A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?
⚠ Common exam trap
The CAS-004 exam often tests the principle of least privilege and secure credential handling in automation contexts, and the trap here is that candidates may choose root privileges (Option C) thinking it ensures full access to all images, overlooking the security risk of excessive permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized queries or input sanitization for any user-supplied data
Input sanitization and parameterized queries prevent injection attacks when the script processes user-supplied data, such as image names or tags. In the context of container scanning, unsanitized input could lead to command injection or SQL injection if the script queries a vulnerability database. This aligns with secure coding practices for automation scripts, ensuring that the script does not inadvertently execute malicious commands or expose sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode API keys into the script for simplicity
Why it's wrong here
Hardcoding credentials is a major security risk; they can be exposed in version control.
- ✗
Run the script with root privileges to ensure it has access to all images
Why it's wrong here
Running with least privilege is a security best practice; root access increases the attack surface.
- ✗
Store credentials in a world-readable configuration file
Why it's wrong here
Credentials should be stored securely (e.g., vault, environment variables), not world-readable.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CAS-005 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use parameterized queries or input sanitization for any user-supplied dataCorrect answer▾
✗Hardcode API keys into the script for simplicityWrong answer — click to see why▾
Why this is wrong here
Hardcoding credentials is a major security risk; they can be exposed in version control.
✗Run the script with root privileges to ensure it has access to all imagesWrong answer — click to see why▾
Why this is wrong here
Running with least privilege is a security best practice; root access increases the attack surface.
✗Store credentials in a world-readable configuration fileWrong answer — click to see why▾
Why this is wrong here
Credentials should be stored securely (e.g., vault, environment variables), not world-readable.
Analysis generated from the official CAS-005blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.