easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A CI pipeline blocks a container image because…
A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?
⚠ Common exam trap
CompTIA often tests the misconception that a vulnerability can be safely ignored simply because the application team claims the binary is unused, without requiring validation or a documented risk acceptance process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate exploitability and rebuild from a patched base image where feasible
The best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ship the image and document nothing
Why it's wrong here
Risk acceptance requires evidence and approval.
- ✓
Validate exploitability and rebuild from a patched base image where feasible
Why this is correct
Container findings should consider reachability, but rebuilding from a patched base reduces inherited risk.
- ✗
Only rename the image tag
Why it's wrong here
Renaming does not change vulnerable contents.
- ✗
Ignore all base-image vulnerabilities
Why it's wrong here
Inherited dependencies can still create exploitable paths.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
CVE
CVE stands for Common Vulnerabilities and Exposures, which is a publicly available list of standardized identifiers for known security vulnerabilities in software and hardware.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.