hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Deploying a containerized microservices…
A company is deploying a containerized microservices architecture on Azure Kubernetes Service (AKS). The security team requires that all container images are scanned for vulnerabilities before deployment. Which deployment approach should the DevOps team implement to ensure only approved images are used?
⚠ Common exam trap
Test-takers frequently confuse image signing (e.g., Docker Content Trust or Notary) with vulnerability scanning, assuming that signing alone ensures security, but signing only verifies image origin and integrity, not the presence of vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Container Registry tasks for automatic vulnerability scanning and enforce with Azure Policy.
Azure Container Registry (ACR) Tasks can automatically scan images for vulnerabilities using Microsoft Defender for Cloud, and Azure Policy can enforce that only images from approved registries or with passing scan results are deployed to AKS. This ensures that all container images are scanned before deployment and that only compliant images are used, meeting the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store all images in a private registry without any scanning.
Why it's wrong here
No vulnerability assessment.
- ✗
Use Docker Content Trust to sign images and verify signatures during deployment.
Why it's wrong here
Signing ensures integrity but not vulnerability scanning.
- ✓
Enable Azure Container Registry tasks for automatic vulnerability scanning and enforce with Azure Policy.
Why this is correct
ACR tasks scan images and Azure Policy can deny non-compliant deployments.
- ✗
Deploy an admission controller that checks image signatures only.
Why it's wrong here
Missing vulnerability scanning.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.