CCSP Cloud Application Security Practice Question
A healthcare SaaS company runs containerized microservices on Google Kubernetes Engine (GKE). The security team scans containers with a vulnerability scanner and finds that base images have several critical vulnerabilities. The container build process uses a Dockerfile that pulls the latest Ubuntu image from Docker Hub. The team wants to reduce the attack surface without delaying feature releases. What is the best approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adopt minimal hardened base images and integrate vulnerability scanning into CI/CD
Adopting minimal hardened base images (such as distroless or Alpine-based images) reduces the attack surface by including only necessary packages, and integrating vulnerability scanning into the CI/CD pipeline ensures that vulnerabilities are detected and addressed before deployment. Option A (restricting outbound traffic) does not address the vulnerabilities within the images. Option B (scheduled weekly rebuilds) still relies on the same vulnerable base images and leaves a window of exposure. Option D (refactoring all applications to use scratch) is generally impractical because scratch images lack essential libraries and binaries, making them unsuitable for most applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place a network security policy to restrict outbound traffic from pods
Why it's wrong here
Network controls do not fix vulnerable images inside the container.
- ✗
Schedule weekly automated rebuilds with the latest base image
Why it's wrong here
Weekly rebuilds are insufficient; threats emerge quickly.
- ✓
Adopt minimal hardened base images and integrate vulnerability scanning into CI/CD
Why this is correct
Hardened images minimize vulnerabilities and scanning ensures early detection.
- ✗
Refactor all applications to use scratch as base image
Why it's wrong here
Rebuilding from scratch introduces custom complexity and maintenance overhead.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.