hardMultiple SelectObjective-mapped
CCSP Practice Question: A cloud security architect is designing a secure…
A cloud security architect is designing a secure CI/CD pipeline for a containerized application deployed on a Kubernetes cluster. The pipeline must ensure that only approved images are deployed. Which TWO of the following controls should be implemented? (Choose two.)
⚠ Common exam trap
ISC2 often tests the distinction between controls that prevent unauthorized images from being deployed (signing and admission control) versus controls that manage access or detect vulnerabilities but do not enforce approval at deployment time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Kubernetes admission controller to reject pods that use unsigned images.
Kubernetes admission controllers can enforce policies such as rejecting pods that use unsigned images, ensuring only images with verified signatures are deployed. This directly addresses the requirement to deploy only approved images by validating image integrity at admission time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement role-based access control (RBAC) to restrict who can push images to the registry.
Why it's wrong here
RBAC controls who can push images but does not verify the content of the images or enforce deployment policies.
- ✓
Configure the Kubernetes admission controller to reject pods that use unsigned images.
Why this is correct
An admission controller can enforce policies at deployment time, rejecting pods that do not meet criteria such as image signature verification.
- ✗
Use network policies to restrict pod-to-pod communication.
Why it's wrong here
Network policies control traffic flow between pods, not which images are allowed to be deployed.
- ✗
Scan all container images for vulnerabilities in the CI pipeline.
Why it's wrong here
Vulnerability scanning is important but does not enforce that only approved images are deployed; it only identifies known vulnerabilities.
- ✓
Sign container images with a private key and verify signatures before deployment.
Why this is correct
Image signing ensures that images come from a trusted source and haven't been tampered with.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.