SY0-701 Security Architecture Practice Question
A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?
⚠ Common exam trap
Many candidates think runtime monitoring (Option C) is sufficient, but it fails to prevent the initial deployment of vulnerable or unapproved images, which is the core requirement of the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scan images in the pipeline and enforce signature verification or admission control before deployment.
It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase CPU and memory limits for the containers so they run more safely.
Why it's wrong here
Adjusting CPU and memory limits only constrains how much compute and memory a container may consume at runtime; it does nothing to reduce known vulnerabilities, malware, or untrusted code baked into the image itself. While resource limits can help prevent one compromised container from exhausting host resources, an image with a critical CVE or a rogue dependency will still execute with the same privileges and risk. This is a performance/stability control, not a supply-chain or image-integrity control, so it fails to address the actual dependency and trust problems in CI/CD pipelines.
- ✗
Allow developers to pull images from any registry as long as the tags look familiar.
Why it's wrong here
Relying on familiar-looking tags is inherently insecure because container image tags are mutable strings—an attacker with access to a registry can re-point a familiar tag to a malicious image without changing its name. Tags provide no cryptographic guarantee of provenance, so an image pulled from an arbitrary registry could be a typosquat or a tampered rebuild even if the tag appears legitimate. Proper supply-chain security requires immutable digests, registry allowlisting, and signature verification, not subjective visual confirmation of a tag.
- ✗
Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.
Why it's wrong here
Disabling build-time scanning trades a few minutes of pipeline time for the risk of shipping an image with known CVEs, exposed secrets, or vulnerable base layers directly into production. Runtime monitoring is reactive: it can alert to anomalous behavior after deployment, but it cannot prevent the initial exploit or stop an image from running with a critical kernel-level vulnerability from day one. The shift-left principle holds that finding and fixing issues in the CI/CD pipeline is far cheaper and safer than relying on post-deployment detection, so eliminating the scanner weakens the overall security posture.
- ✓
Scan images in the pipeline and enforce signature verification or admission control before deployment.
Why this is correct
Build-time scanning helps identify vulnerable packages before release, while signature verification or admission control ensures only approved images can run in the cluster. Together, these controls reduce both content risk and deployment risk. This is the strongest combined answer because it addresses prevention and policy enforcement.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.