CCSP Cloud Application Security Practice Question
A security architect is designing a CI/CD pipeline for a cloud-native application. The team wants to automatically scan container images for vulnerabilities before deployment. Which of the following is the most effective approach?
⚠ Common exam trap
It's easy for candidates to confuse runtime host-based scanning (Option C) with image scanning, but the question specifically asks for scanning before deployment, making pipeline integration the only correct choice that enforces security gates early in the lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate a container image scanner into the pipeline
Integrating a container image scanner into the CI/CD pipeline ensures that vulnerabilities are detected early, before the image is deployed to production. This approach automates security checks as part of the build process, aligning with DevSecOps principles by shifting security left. Tools like Trivy, Clair, or Anchore can be configured to fail the pipeline if critical vulnerabilities are found, preventing insecure images from reaching runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually review images before each deployment
Why it's wrong here
Manual review cannot scale across frequent CI/CD builds and introduces human error and delay, so vulnerable images still reach deployment. Automated pipeline scanning is required to gate every build. Manual review suits low-volume, high-risk releases where automation is impractical, not continuous cloud-native delivery.
- ✓
Integrate a container image scanner into the pipeline
Why this is correct
Embedding a container image scanner as a pipeline stage inspects each built image for known CVEs before deployment, failing the build on policy violations. This shifts detection left, blocking vulnerable images from reaching the cluster rather than scanning after release.
- ✗
Perform vulnerability scanning at runtime using a host-based agent
Why it's wrong here
Runtime host agents detect vulnerabilities after images are already deployed, so malicious or flawed layers reach production before any alert. Scanning belongs earlier, in the pipeline, where images can be blocked pre-deployment. Runtime agent scanning is correct for monitoring live workloads against zero-days, not gating builds.
- ✗
Scan the network for open ports on the container hosts
Why it's wrong here
Port scanning inspects network exposure on hosts, revealing nothing about vulnerable packages or libraries inside image layers, so known CVEs pass undetected. It is correct for auditing firewall rules and exposed services, not for assessing container image contents before deployment.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.