CCSP Cloud Application Security Practice Question
Which TWO measures are effective for securing container images in a cloud environment?
⚠ Common exam trap
ISC2 often tests the misconception that 'latest tags are safe because they always point to the most recent version,' but the trap is that 'latest' is a mutable tag that can silently introduce breaking changes or vulnerabilities, whereas version pinning (e.g., using a specific digest or semantic version) ensures deterministic and auditable deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign images to ensure integrity
Signing container images (e.g., using Docker Content Trust or Notary) ensures integrity and authenticity by cryptographically verifying that the image has not been tampered with since it was signed. This prevents man-in-the-middle attacks and the deployment of malicious images, which is a critical security measure in cloud environments where images are pulled from remote registries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store images in a public registry without scanning
Why it's wrong here
Public registries without scanning expose to known vulnerabilities.
- ✓
Sign images to ensure integrity
Why this is correct
Signing container images with cryptographic hashes, verified against a trusted registry or key management system, ensures that the image has not been tampered with during transit or storage, directly satisfying the integrity constraint of the cloud environment. This mechanism prevents unauthorised modifications, such as injected malware, from being deployed in production, which is critical for maintaining a secure supply chain.
- ✗
Use latest tags without version pinning
Why it's wrong here
Using latest tags can lead to unexpected changes.
- ✗
Run containers with root privileges
Why it's wrong here
Running as root increases risk of container escape.
- ✓
Scan images for vulnerabilities before deployment
Why this is correct
Scanning identifies known vulnerabilities in images.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.