easyMultiple Choice
CS0-003 Practice Question: A CI pipeline blocks a container image because…
A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?
⚠ Common exam trap
The CS0-004 exam often tests the misconception that a vulnerability can be safely ignored if the application team claims the binary is unused, but the trap is that without validation (e.g., runtime reachability analysis), the claim may be false due to transitive dependencies or dynamic loading.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate exploitability and rebuild from a patched base image where feasible
The best next step is to validate whether the vulnerable OpenSSL binary is actually reachable or exploitable in the running container, and then rebuild from a patched base image if feasible. This balances security with business priorities by avoiding unnecessary rebuilds for non-exploitable vulnerabilities while ensuring that truly exploitable CVEs are remediated. Simply ignoring or renaming the tag does not address the underlying risk and violates secure CI/CD practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore all base-image vulnerabilities
Why it's wrong here
Ignoring all base-image vulnerabilities is a critical security oversight because inherited dependencies within the base layer can still create exploitable paths, even if the application code itself does not directly invoke the vulnerable component. Attackers can leverage these underlying weaknesses in the operating system, libraries, or runtime environment to gain unauthorized access, elevate privileges, or execute malicious code. This practice fundamentally undermines the security posture of the deployed container.
- ✗
Only rename the image tag
Why it's wrong here
Only renaming the image tag is a superficial action that provides no security benefit whatsoever. Renaming merely alters the metadata identifier for the container image within a registry; it does not modify the binary contents, embedded libraries, or configuration files that constitute the image itself. Consequently, any identified vulnerabilities persist unchanged, leaving the container just as susceptible to exploitation as before the cosmetic alteration.
- ✓
Validate exploitability and rebuild from a patched base image where feasible
Why this is correct
Validating exploitability is a crucial first step to prioritize remediation efforts by determining if a vulnerability is reachable and impactful within the specific container context. Subsequently, rebuilding the image from a patched base image directly addresses the root cause of the vulnerability at its foundational layer. This proactive approach significantly reduces the inherited risk, ensures the deployment of secure artifacts, and aligns with best practices for maintaining a robust software supply chain.
- ✗
Ship the image and document nothing
Why it's wrong here
Shipping a vulnerable image without any documentation or formal risk acceptance is a severe breach of security governance and risk management principles. This practice bypasses necessary oversight, accountability, and transparency, leaving the organization exposed to unquantified and unmanaged risks. Proper risk acceptance requires a thorough assessment, documented mitigation plans, and explicit approval from relevant stakeholders, none of which occur when documentation is absent.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.