This CCSP practice question tests your understanding of cloud application security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-build image scanning in registry
Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Runtime security monitoring
Why it's wrong here
Runtime monitoring detects threats in production, not before deployment.
✗
Pre-commit hook in source control
Why it's wrong here
Pre-commit hooks check source code, not built container images.
✓
Post-build image scanning in registry
Why this is correct
Scanning images in the registry after build ensures vulnerabilities are detected before deployment.
Related concept
Read the scenario before looking for a memorised answer.
✗
Admission controller in Kubernetes
Why it's wrong here
Admission controllers can reject vulnerable images but scanning in registry is a more proactive and earlier control.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between proactive pipeline controls (like post-build scanning) and reactive runtime controls (like admission controllers), leading candidates to choose admission controllers because they seem directly related to Kubernetes security, but they miss the earlier, more effective integration point.
Detailed technical explanation
How to think about this question
Container image scanning in the registry typically uses tools like Trivy, Clair, or Anchore to analyze layers against CVE databases (e.g., NVD, Red Hat OVAL). The scan occurs after the image is tagged and pushed, allowing the pipeline to fail or halt if critical vulnerabilities are found, often via webhook integration or registry notification systems. In real-world scenarios, this prevents supply chain attacks where a base image update introduces a known vulnerability, as the scan catches it before the image reaches the cluster.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Cloud Application Security — This question tests Cloud Application Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Post-build image scanning in registry — Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.
What should I do if I get this CCSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.