easyMultiple Choice
CS0-003 Practice Question: A CI pipeline blocks a container image because…
A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?
⚠ Common exam trap
CompTIA often tests the misconception that a vulnerability can be safely ignored simply because the application team claims the binary is unused, without requiring validation or a documented risk acceptance process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate exploitability and rebuild from a patched base image where feasible
The best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ship the image and document nothing
Why it's wrong here
Shipping without documentation leaves no evidence that the binary is unreachable, so the critical finding cannot be closed or downgraded. Silent deployment suits low-risk changes, not unresolved critical CVEs requiring documented compensating controls or reachability proof.
- ✓
Validate exploitability and rebuild from a patched base image where feasible
Why this is correct
Validate exploitability to confirm whether the vulnerable OpenSSL binary is reachable, then rebuild from a patched base image where feasible. This satisfies the stem's constraint of evidence before closing or downgrading, since unused code paths may lower risk but patching remains the durable fix.
- ✗
Only rename the image tag
Why it's wrong here
Renaming the tag changes no layer content, so the vulnerable OpenSSL binary remains in the image and the finding stands. Tag changes are legitimate for release or rollback management, not for remediating or evidencing a CVE.
- ✗
Ignore all base-image vulnerabilities
Why it's wrong here
Ignoring base-image findings removes the only evidence needed to justify downgrading the CVE. The stem requires validation that the vulnerable OpenSSL binary is unreachable, which demands inspection of the image layer and runtime dependencies. Ignoring suits environments where base layers are rebuilt nightly and findings are tracked centrally, not a pipeline actively blocking the build.
Go deeper
Related to this question
Learn chapter
Security SLAs and SLOs
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
CVE
CVE stands for Common Vulnerabilities and Exposures, which is a publicly available list of standardized identifiers for known security vulnerabilities in software and hardware.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.