hardMultiple SelectObjective-mapped
CAS-004 Practice Question: When evaluating the security architecture of a…
When evaluating the security architecture of a containerized application, which THREE of the following practices should be implemented to minimize the attack surface? (Select THREE.)
⚠ Common exam trap
CompTIA CASP+ often tests the distinction between security controls that protect data (encryption, MFA) versus controls that reduce the attack surface (minimal images, read-only filesystems, dropped capabilities), causing candidates to select all seemingly 'secure' options rather than those that specifically minimize exploitable components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use minimal base images (e.g., Alpine Linux) instead of full OS images
Using minimal base images like Alpine Linux reduces the number of installed packages, libraries, and utilities, which directly shrinks the attack surface by eliminating unnecessary components that could contain vulnerabilities. This practice aligns with the principle of least functionality, ensuring only essential binaries are present in the container image.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt sensitive data at rest within the container
Why it's wrong here
Encryption protects data but does not reduce attack surface.
- ✓
Use minimal base images (e.g., Alpine Linux) instead of full OS images
Why this is correct
Smaller images have fewer packages and vulnerabilities.
- ✗
Implement multi-factor authentication for container registries
Why it's wrong here
MFA secures access but does not reduce the container's attack surface.
- ✓
Set container file systems to read-only where possible
Why this is correct
Read-only prevents unauthorized writes and malware installation.
- ✓
Drop all capabilities except those required for the application
Why this is correct
Removing capabilities reduces kernel attack surface.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.