SY0-701 Security Architecture Practice Question
A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?
⚠ Common exam trap
Candidates often confuse operational practices (like running as root or opening ports) with security controls that directly address software supply chain risks, or mistakenly think that adding resources can compensate for insecure image content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scan the image and rebuild it from an approved base image.
Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run the container as root so startup problems are less likely.
Why it's wrong here
Running the container as root violates the principle of least privilege and creates a larger attack surface for any process-level exploit to execute with elevated privileges on the host if the kernel is vulnerable. It also does nothing to remove known vulnerable libraries from the image; those CVEs persist regardless of the runtime UID. A compromised root container can lead to host takeover in many misconfigured environments.
- ✓
Scan the image and rebuild it from an approved base image.
Why this is correct
Scanning the image with a CVE-aware tool (e.g., Trivy, Grype) identifies known vulnerable packages before deployment, while rebuilding from an approved, hardened base image ensures the image starts from a patched and trusted foundation, eliminating many supply-chain risks. This is a preventive control that reduces the likelihood of an attacker exploiting a known flaw in runtime dependencies. The combination of automated scanning and trusted base images is a core DevSecOps practice.
- ✗
Open the container port on the host firewall so the image can be reached faster.
Why it's wrong here
Opening a container port on the host firewall changes the network exposure by making the service reachable from additional networks or hosts, but it has zero effect on the image's software bill of materials. The vulnerable binaries, libraries, and configuration files inside the image remain untouched, so the risk of exploitation is actually increased rather than reduced. This option conflates network tuning with vulnerability remediation, and it can unintentionally expose an unpatched service to broader attack traffic.
- ✗
Add more CPU and memory to the cluster to improve image security.
Why it's wrong here
Adding more CPU and memory to the cluster increases the compute capacity available to the container, which can mask performance issues but does not alter the image's underlying Linux packages, application code, or runtime libraries. Any known CVE present in the base OS or third-party dependencies will still exist after resource scaling, so the system remains exploitable. In fact, added resources can allow a denial-of-service attack to consume even more compute before hitting limits, making the situation worse from a security operations standpoint.
Visual reference
Go deeper
Related to this question
Learn chapter
Firewall Types and Deployment
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.
easy- ✓ A.Scan images for known vulnerabilities before they are promoted to production.
- ✓ B.Use trusted minimal base images and remove unnecessary packages.
- C.Run containers as root by default to simplify troubleshooting.
- D.Mount the host operating system filesystem into every container.
- E.Deploy images using the latest tag without reviewing version history.
Why A: Scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.