How should I use these Scripting, Containers and Automation practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CAS-004 · topic practice

Scripting, Containers and Automation practice questions

Q: Can I practise just Scripting, Containers and Automation questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scripting, Containers and Automation domain.

Practise CompTIA SecurityX CAS-004 Scripting, Containers and Automation practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Scripting, Containers and Automation

Practice 10 questions Browse domain →

What the exam tests

What to know about Scripting, Containers and Automation

Scripting, Containers and Automation questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scripting, Containers and Automation exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scripting, Containers and Automation questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Scripting, Containers and Automation explanation →

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

Trap 1: Reduces operational costs by reusing existing servers

Immutable infrastructure typically increases costs because new instances are spun up instead of patching old ones.

Trap 2: Increases system performance through hardware acceleration

Immutable infrastructure is about deployment methodology, not hardware performance.

Trap 3: Simplifies monitoring by reducing the number of servers

Immutable infrastructure may actually increase server count due to frequent redeployments.

Study all Scripting, Containers and Automation common traps →

A
Reduces operational costs by reusing existing servers
Why wrong: Immutable infrastructure typically increases costs because new instances are spun up instead of patching old ones.
C
Increases system performance through hardware acceleration
Why wrong: Immutable infrastructure is about deployment methodology, not hardware performance.
D
Simplifies monitoring by reducing the number of servers
Why wrong: Immutable infrastructure may actually increase server count due to frequent redeployments.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Scripting, Containers and Automation explanation →

A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?

Trap 1: Hardcode API keys into the script for simplicity

Hardcoding credentials is a major security risk; they can be exposed in version control.

Trap 2: Run the script with root privileges to ensure it has access to all…

Running with least privilege is a security best practice; root access increases the attack surface.

Trap 3: Store credentials in a world-readable configuration file

Credentials should be stored securely (e.g., vault, environment variables), not world-readable.

Study all Scripting, Containers and Automation common traps →

A
Hardcode API keys into the script for simplicity
Why wrong: Hardcoding credentials is a major security risk; they can be exposed in version control.
C
Run the script with root privileges to ensure it has access to all images
Why wrong: Running with least privilege is a security best practice; root access increases the attack surface.
D
Store credentials in a world-readable configuration file
Why wrong: Credentials should be stored securely (e.g., vault, environment variables), not world-readable.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Scripting, Containers and Automation explanation →

An organization implements a CI/CD pipeline that automatically builds and deploys containerized microservices. Which of the following is the most effective method to ensure that only signed, trusted container images are deployed to production?

Trap 1: Implement a private container registry with access controls

Access controls prevent unauthorized pushes but do not verify the integrity or authenticity of images.

Trap 2: Run vulnerability scanning on all images before deployment

Scanning identifies vulnerabilities but does not verify the publisher's identity or prevent tampering.

Trap 3: Use an admission controller that checks image labels

Labels are metadata and can be easily spoofed; they do not provide cryptographic proof of origin.

Study all Scripting, Containers and Automation common traps →

A
Implement a private container registry with access controls
Why wrong: Access controls prevent unauthorized pushes but do not verify the integrity or authenticity of images.
C
Run vulnerability scanning on all images before deployment
Why wrong: Scanning identifies vulnerabilities but does not verify the publisher's identity or prevent tampering.
D
Use an admission controller that checks image labels
Why wrong: Labels are metadata and can be easily spoofed; they do not provide cryptographic proof of origin.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Scripting, Containers and Automation explanation →

A DevOps engineer is automating the deployment of a web application using containers. Which of the following security practices should be implemented to reduce the attack surface of the containers? (Select TWO.)

Trap 1: Build images with embedded database credentials

Embedding secrets in images is insecure; they should be injected at runtime.

Trap 2: Expose port 22 for SSH debugging

Exposing SSH adds an attack vector and is unnecessary in production.

Trap 3: Grant all Linux capabilities to the container

Granting all capabilities weakens isolation; should drop all unnecessary capabilities.

Study all Scripting, Containers and Automation common traps →

B
Build images with embedded database credentials
Why wrong: Embedding secrets in images is insecure; they should be injected at runtime.
D
Expose port 22 for SSH debugging
Why wrong: Exposing SSH adds an attack vector and is unnecessary in production.
E
Grant all Linux capabilities to the container
Why wrong: Granting all capabilities weakens isolation; should drop all unnecessary capabilities.

Full breakdown with real-world context →

Question 5hardmulti select

Study the full Python automation breakdown →

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Trap 1: Use os.system() to run shell commands for resource management

os.system is vulnerable to injection; prefer subprocess with parameterized commands.

Trap 2: Hardcode API tokens as fallback if environment variables are missing

Hardcoding tokens is insecure and defeats the purpose of using environment variables.

Trap 3: Log the API tokens for troubleshooting purposes

Logging credentials exposes them in logs, which is a security risk.

Study all Scripting, Containers and Automation common traps →

B
Use os.system() to run shell commands for resource management
Why wrong: os.system is vulnerable to injection; prefer subprocess with parameterized commands.
C
Hardcode API tokens as fallback if environment variables are missing
Why wrong: Hardcoding tokens is insecure and defeats the purpose of using environment variables.
E
Log the API tokens for troubleshooting purposes
Why wrong: Logging credentials exposes them in logs, which is a security risk.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Scripting, Containers and Automation explanation →

Match each automation security concept with its correct description.

Trap 1: Immutable infrastructure

Matched to correct description

Trap 2: Infrastructure as Code

Matched to correct description

Trap 3: Secret management

Matched to correct description

Study all Scripting, Containers and Automation common traps →

A
Immutable infrastructure
Why wrong: Matched to correct description
B
Infrastructure as Code
Why wrong: Matched to correct description
C
Secret management
Why wrong: Matched to correct description
D
Container orchestration
Why wrong: Matched to correct description

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Scripting, Containers and Automation explanation →

Which of the following best describes the primary security benefit of using immutable infrastructure in a containerized environment?

Trap 1: It reduces resource consumption by reusing containers.

Immutable infrastructure usually increases resource usage due to frequent replacement; reuse is not a security benefit.

Trap 2: It automates patching of container images.

Immutable infrastructure requires rebuilding images for patches, but it does not automate the patching itself.

Trap 3: It eliminates the need for container security scanning.

Immutable infrastructure still requires scanning images for vulnerabilities before deployment.

Study all Scripting, Containers and Automation common traps →

A
It reduces resource consumption by reusing containers.
Why wrong: Immutable infrastructure usually increases resource usage due to frequent replacement; reuse is not a security benefit.
C
It automates patching of container images.
Why wrong: Immutable infrastructure requires rebuilding images for patches, but it does not automate the patching itself.
D
It eliminates the need for container security scanning.
Why wrong: Immutable infrastructure still requires scanning images for vulnerabilities before deployment.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full Python automation breakdown →

A security engineer is writing a Python script to automate the revocation of compromised credentials across multiple cloud services. Which of the following is the most critical security consideration when implementing this script?

Trap 1: Ensure the script runs with the least privilege necessary.

Important but not the most critical; the script's credentials must be protected first.

Trap 2: Log all actions performed by the script.

Logging is good for auditing but does not protect the script's credentials.

Trap 3: Run the script from a hardened bastion host.

While a hardened host reduces risk, the script's secrets are still exposed if hardcoded.

Study all Scripting, Containers and Automation common traps →

A
Ensure the script runs with the least privilege necessary.
Why wrong: Important but not the most critical; the script's credentials must be protected first.
C
Log all actions performed by the script.
Why wrong: Logging is good for auditing but does not protect the script's credentials.
D
Run the script from a hardened bastion host.
Why wrong: While a hardened host reduces risk, the script's secrets are still exposed if hardcoded.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Scripting, Containers and Automation explanation →

An organization uses a CI/CD pipeline that builds Docker images and pushes them to a private registry. A security analyst discovers that some images contain environment variables with database credentials. Which of the following is the most effective way to prevent this in the future?

Trap 1: Use a .dockerignore file to exclude credential files.

.dockerignore prevents copying files but does not eliminate secrets set via ENV or build args.

Trap 2: Scan images with a vulnerability scanner after build.

Scanning detects known vulnerabilities, not embedded secrets.

Trap 3: Reduce the base image size to minimize attack surface.

Size reduction does not remove secrets already embedded.

Study all Scripting, Containers and Automation common traps →

A
Use a .dockerignore file to exclude credential files.
Why wrong: .dockerignore prevents copying files but does not eliminate secrets set via ENV or build args.
C
Scan images with a vulnerability scanner after build.
Why wrong: Scanning detects known vulnerabilities, not embedded secrets.
D
Reduce the base image size to minimize attack surface.
Why wrong: Size reduction does not remove secrets already embedded.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Scripting, Containers and Automation explanation →

Which two of the following are best practices for securing container orchestration platforms (e.g., Kubernetes)? (Select two.)

Trap 1: Use privileged containers for system services.

Privileged containers should be avoided as they have nearly unrestricted access to the host.

Trap 2: Disable all security contexts to avoid restrictions.

Security contexts enforce necessary restrictions; disabling them weakens security.

Study all Scripting, Containers and Automation common traps →

B
Use privileged containers for system services.
Why wrong: Privileged containers should be avoided as they have nearly unrestricted access to the host.
C
Disable all security contexts to avoid restrictions.
Why wrong: Security contexts enforce necessary restrictions; disabling them weakens security.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Ansible explanation →

A security team is automating incident response using playbooks. Which two of the following are critical considerations when designing automated response actions? (Select two.)

Trap 1: Execute all actions immediately to minimize damage.

Immediate execution without validation can cause collateral damage.

Trap 2: Use the same playbook for all incident types.

Different incidents require tailored responses; one-size-fits-all is ineffective.

Study all Scripting, Containers and Automation common traps →

A
Execute all actions immediately to minimize damage.
Why wrong: Immediate execution without validation can cause collateral damage.
D
Use the same playbook for all incident types.
Why wrong: Different incidents require tailored responses; one-size-fits-all is ineffective.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Scripting, Containers and Automation explanation →

Match each container security concept with its correct description.

Question 13easymultiple choice

Read the full Scripting, Containers and Automation explanation →

Which of the following is the primary benefit of using infrastructure as code (IaC) for automating security configurations?

Trap 1: It eliminates the need for security testing

IaC does not eliminate testing; it automates deployment.

Trap 2: It allows unapproved changes to be deployed faster

Unapproved changes are a risk, not a benefit.

Trap 3: It increases manual oversight of security settings

IaC reduces manual oversight.

Study all Scripting, Containers and Automation common traps →

A
It eliminates the need for security testing
Why wrong: IaC does not eliminate testing; it automates deployment.
C
It allows unapproved changes to be deployed faster
Why wrong: Unapproved changes are a risk, not a benefit.
D
It increases manual oversight of security settings
Why wrong: IaC reduces manual oversight.

Full breakdown with real-world context →

Question 14mediummultiple choice

Study the full Python automation breakdown →

A security analyst is writing a Python script to parse network logs and automatically block IP addresses that exceed a threshold of failed login attempts. Which security consideration is most critical when implementing this automation?

Trap 1: Using the most efficient parsing algorithm

Efficiency is secondary; security is paramount.

Trap 2: Ensuring the script runs with root privileges

Least privilege principle suggests non-root.

Trap 3: Writing detailed audit logs of script actions

Auditing is important but not the most critical.

Study all Scripting, Containers and Automation common traps →

A
Using the most efficient parsing algorithm
Why wrong: Efficiency is secondary; security is paramount.
B
Ensuring the script runs with root privileges
Why wrong: Least privilege principle suggests non-root.
D
Writing detailed audit logs of script actions
Why wrong: Auditing is important but not the most critical.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Scripting, Containers and Automation explanation →

In a CI/CD pipeline, a container image is built from a Dockerfile that uses a base image from a public registry. To minimize the attack surface, which of the following actions should be automated in the pipeline?

Trap 1: Use the 'latest' tag for the base image to get latest patches

'latest' can introduce breaking changes or untested versions.

Trap 2: Store the Dockerfile in a private repository only

Storage location does not reduce attack surface.

Trap 3: Install all available packages inside the container

Installing extra packages increases attack surface.

Study all Scripting, Containers and Automation common traps →

A
Use the 'latest' tag for the base image to get latest patches
Why wrong: 'latest' can introduce breaking changes or untested versions.
C
Store the Dockerfile in a private repository only
Why wrong: Storage location does not reduce attack surface.
D
Install all available packages inside the container
Why wrong: Installing extra packages increases attack surface.

Full breakdown with real-world context →

Question 16mediummulti select

Read the full Scripting, Containers and Automation explanation →

Which of the following are secure scripting practices when automating administrative tasks? (Choose two.)

Trap 1: Hardcode credentials in the script for convenience

Hardcoding exposes secrets in version control.

Trap 2: Run the script with the highest privileges required

Should run with least privilege, not highest.

Study all Scripting, Containers and Automation common traps →

A
Hardcode credentials in the script for convenience
Why wrong: Hardcoding exposes secrets in version control.
C
Run the script with the highest privileges required
Why wrong: Should run with least privilege, not highest.

Full breakdown with real-world context →

Question 17hardmulti select

Read the full Scripting, Containers and Automation explanation →

A DevOps engineer is automating container orchestration using Kubernetes. Which of the following are security best practices to include in the automation? (Choose two.)

Trap 1: Disable RBAC to simplify automation scripts

RBAC is a critical security control.

Trap 2: Allow all network traffic between pods for simplicity

Network policies should restrict traffic.

Study all Scripting, Containers and Automation common traps →

A
Disable RBAC to simplify automation scripts
Why wrong: RBAC is a critical security control.
C
Allow all network traffic between pods for simplicity
Why wrong: Network policies should restrict traffic.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Scripting, Containers and Automation explanation →

Match each automation security concept (left) with its corresponding best practice (right).

Question 19hardmultiple choice

Study the full Python automation breakdown →

A security engineer is writing a Python script to automate the revocation of compromised certificates using the ACME protocol. The script uses the `acme` library and requires secure credential storage. Which method is MOST appropriate for storing the ACME account private key used for authentication?

Trap 1: Store the key in a configuration file with 600 permissions

The key remains in plaintext on disk; even with restricted permissions, it can be read by any process running as the same user or through privilege escalation.

Trap 2: Embed the key directly in the script as a string variable

The key is exposed in source code, version control, and accessible to anyone who can read the script.

Trap 3: Store the key in an environment variable

Environment variables are often written to logs, process dumps, and are not encrypted at rest; they are not designed for long-term cryptographic key storage.

Study all Scripting, Containers and Automation common traps →

B
Store the key in a configuration file with 600 permissions
Why wrong: The key remains in plaintext on disk; even with restricted permissions, it can be read by any process running as the same user or through privilege escalation.
C
Embed the key directly in the script as a string variable
Why wrong: The key is exposed in source code, version control, and accessible to anyone who can read the script.
D
Store the key in an environment variable
Why wrong: Environment variables are often written to logs, process dumps, and are not encrypted at rest; they are not designed for long-term cryptographic key storage.

Full breakdown with real-world context →

Question 20mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to configure a site-to-site IPsec VPN on a firewall into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scripting, Containers and Automation sessions

Start a Scripting, Containers and Automation only practice session

Every question in these sessions is drawn from the Scripting, Containers and Automation domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scripting, Containers and Automation questions →Mixed CAS-004 session

Frequently asked questions

What does the CAS-004 exam test about Scripting, Containers and Automation?: Scripting, Containers and Automation questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scripting, Containers and Automation questions in a focused session?: Yes — the session launcher on this page draws every question from the Scripting, Containers and Automation domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CAS-004 topics?: Use the topic links above to move to related areas, or go back to the CAS-004 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CAS-004 exam covers. They are not copied from any real exam or dump site.

Scripting, Containers and Automation only

10 questions 20 questions 30 questions 50 questions

Mixed CAS-004 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CAS-004 questions Scripting, Containers and Automation domain overview CAS-004 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scripting, Containers and Automation practice questions

What to know about Scripting, Containers and Automation

Common Scripting, Containers and Automation exam traps

Scripting, Containers and Automation questions

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?

An organization implements a CI/CD pipeline that automatically builds and deploys containerized microservices. Which of the following is the most effective method to ensure that only signed, trusted container images are deployed to production?

A DevOps engineer is automating the deployment of a web application using containers. Which of the following security practices should be implemented to reduce the attack surface of the containers? (Select TWO.)

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Match each automation security concept with its correct description.

Which of the following best describes the primary security benefit of using immutable infrastructure in a containerized environment?

A security engineer is writing a Python script to automate the revocation of compromised credentials across multiple cloud services. Which of the following is the most critical security consideration when implementing this script?

An organization uses a CI/CD pipeline that builds Docker images and pushes them to a private registry. A security analyst discovers that some images contain environment variables with database credentials. Which of the following is the most effective way to prevent this in the future?

Which two of the following are best practices for securing container orchestration platforms (e.g., Kubernetes)? (Select two.)

A security team is automating incident response using playbooks. Which two of the following are critical considerations when designing automated response actions? (Select two.)

Match each container security concept with its correct description.

Which of the following is the primary benefit of using infrastructure as code (IaC) for automating security configurations?

A security analyst is writing a Python script to parse network logs and automatically block IP addresses that exceed a threshold of failed login attempts. Which security consideration is most critical when implementing this automation?

In a CI/CD pipeline, a container image is built from a Dockerfile that uses a base image from a public registry. To minimize the attack surface, which of the following actions should be automated in the pipeline?

Which of the following are secure scripting practices when automating administrative tasks? (Choose two.)

A DevOps engineer is automating container orchestration using Kubernetes. Which of the following are security best practices to include in the automation? (Choose two.)

Match each automation security concept (left) with its corresponding best practice (right).

A security engineer is writing a Python script to automate the revocation of compromised certificates using the ACME protocol. The script uses the `acme` library and requires secure credential storage. Which method is MOST appropriate for storing the ACME account private key used for authentication?

Drag and drop the steps to configure a site-to-site IPsec VPN on a firewall into the correct order.

Track your progress over time

Start a Scripting, Containers and Automation only practice session

Related CAS-004 topic practice pages