mediumMultiple Select
CCSP Practice Question: Which TWO of the following are recommended…
Which TWO of the following are recommended practices for securing container images in a cloud environment? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scanning images for vulnerabilities in the CI pipeline
Option B is correct because integrating image vulnerability scanning (e.g., with tools like Trivy, Clair, or Amazon ECR image scanning) directly into the CI pipeline catches known CVEs in base images and dependencies before they are pushed to a registry or deployed, shifting security left. Option E is correct because cryptographically signing images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) lets orchestrators and admission controllers verify image provenance and integrity, preventing tampered or unauthorized images from running. Option A is wrong because the 'latest' tag is mutable and non-deterministic, so it undermines reproducibility and can silently pull a vulnerable or unexpected build. Option C is wrong because running containers as root violates least privilege and increases the blast radius of a container escape. Option D is wrong because public registries expose images to unauthorized pulls and potential tampering; private, access-controlled registries are the recommended practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using the latest tag for all images
Why it's wrong here
The latest tag is mutable, so the same tag can point to different image digests over time, defeating reproducibility and integrity verification. It tempts because pulling the newest build appears current, which suits disposable development environments where pinned, signed digests are not required.
- ✓
Scanning images for vulnerabilities in the CI pipeline
Why this is correct
Scanning images in the CI pipeline detects known CVEs in base layers and dependencies before the image reaches the registry, satisfying the shift-left requirement. This catches vulnerable components at build time, when remediation is cheapest, rather than after deployment into the cloud environment.
- ✗
Running containers as root user
Why it's wrong here
Running as root grants a compromised container full privileges over the host kernel and mounted resources, breaking least privilege. It tempts because many base images default to root and some legacy workloads need privileged ports, making it workable only in isolated, trusted test environments.
- ✗
Storing images in a public registry for easier access
Why it's wrong here
A public registry exposes images to unauthenticated pulls and tampering, so provenance and confidentiality are lost. It tempts because public registries simplify distribution and caching, which is acceptable for open-source base images containing no proprietary code or secrets.
- ✓
Signing container images with a cryptographic key
Why this is correct
Cryptographic signing lets registries and orchestrators verify provenance and integrity, so only images signed by trusted publishers are admitted. This satisfies the supply-chain integrity constraint by preventing tampered or unauthorised images from running, complementing scanning rather than duplicating it.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.