CCSP Cloud Application Security Practice Question
During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (like scanning and signing) that stop vulnerable images from being deployed versus mitigative controls (like network segmentation or non-root users) that reduce the impact after deployment, leading candidates to select the latter as a substitute for prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement image vulnerability scanning in the CI/CD pipeline
Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement image vulnerability scanning in the CI/CD pipeline
Why this is correct
Scanning can fail the build if critical vulnerabilities are found, preventing deployment.
- ✗
Regularly update base images
Why it's wrong here
Updating is important but does not prevent use of out-of-date or vulnerable images if not enforced.
- ✓
Only allow signed images to be pulled from a trusted registry
Why this is correct
Image signing ensures integrity and authenticity; only approved images are deployed.
- ✗
Use network segmentation to isolate production containers
Why it's wrong here
Network isolation limits blast radius but does not prevent vulnerable images from being deployed.
- ✗
Run all containers as non-root users
Why it's wrong here
This is a defense-in-depth measure but does not prevent deployment of vulnerable images.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.