CCSP Cloud Platform and Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using the :latest tag for base images

  Why it's wrong here

  The :latest tag is mutable, so builds may silently pull a different, potentially vulnerable base image, increasing rather than reducing CVEs. It is tempting for convenience in development, but pinned digests or minimal base images are required to shrink the attack surface.

• ✗

  Adding security agents inside the image

  Why it's wrong here

  Security agents add monitoring or scanning processes, increasing image layers, package count and CVE exposure rather than shrinking it. They are tempting because runtime threat detection and compliance reporting genuinely require in-image agents, but the question asks for attack-surface reduction through removing unnecessary components, which agents do the opposite of.

• ✓

  Using distroless base images

  Why this is correct

  Distroless images contain only the application and its runtime dependencies, omitting package managers, shells and OS utilities. Removing these unnecessary components shrinks the attack surface and reduces the CVE count, directly satisfying the stem's constraint.

• ✗

  Scanning images only at build time

  Why it's wrong here

  Build-time-only scanning leaves images unscanned for vulnerabilities introduced or disclosed after the build, so runtime exposure persists. It is tempting because shift-left scanning catches issues early in CI/CD, and would be correct where the requirement is preventing flawed images from entering the registry rather than continuously reducing deployed attack surface.

Go deeper

Related to this question