CCSP Cloud Application Security Practice Question
A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?
⚠ Common exam trap
ISC2 often tests the distinction between proactive pipeline controls (like post-build scanning) and reactive runtime controls (like admission controllers), leading candidates to choose admission controllers because they seem directly related to Kubernetes security, but they miss the earlier, more effective integration point.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-build image scanning in registry
Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Runtime security monitoring
Why it's wrong here
Runtime monitoring detects threats in production, not before deployment.
- ✗
Pre-commit hook in source control
Why it's wrong here
Pre-commit hooks check source code, not built container images.
- ✓
Post-build image scanning in registry
Why this is correct
Scanning images in the registry after build ensures vulnerabilities are detected before deployment.
- ✗
Admission controller in Kubernetes
Why it's wrong here
Admission controllers can reject vulnerable images but scanning in registry is a more proactive and earlier control.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.