mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Deploying a containerized application using…
A company is deploying a containerized application using Kubernetes. Which practice BEST ensures the security of the container images?
⚠ Common exam trap
A common mix-up: candidates confuse runtime security controls (like root restrictions or escape protection) with image-level security, mistakenly thinking they ensure the image itself is free of vulnerabilities, when in fact they only mitigate exploitation after deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scan images for vulnerabilities and use minimal base images
Scanning container images for known vulnerabilities (e.g., using Trivy, Clair, or Snyk) and using minimal base images (e.g., Alpine or distroless) directly reduces the attack surface and eliminates unnecessary packages that may contain exploitable flaws. This practice is foundational to secure software supply chain management and aligns with the principle of least functionality in containerized environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Scan images for vulnerabilities and use minimal base images
Why this is correct
Scanning container images for vulnerabilities identifies known CVEs and misconfigurations within the software components before deployment. Concurrently, using minimal base images significantly reduces the attack surface by excluding unnecessary libraries, packages, and executables. This dual approach proactively minimizes the number of potential vulnerabilities and limits the scope for exploitation, directly enhancing the security posture of the containerized application.
- ✗
Restrict containers from running as root
Why it's wrong here
While restricting containers from running as root is a fundamental security best practice, it primarily serves to limit the potential impact and privileges an attacker gains if a container is compromised. This measure mitigates post-exploitation damage but does not address or prevent the underlying vulnerabilities that may exist within the container image itself. Therefore, it is not a direct solution for securing the image's contents.
- ✗
Use the latest version of the base image without scanning
Why it's wrong here
Relying solely on the latest version of a base image without conducting vulnerability scanning is an inadequate security strategy. Although newer versions often incorporate bug fixes and security patches, they are not guaranteed to be free of vulnerabilities; new CVEs are constantly discovered, and even recent images can contain unpatched or newly introduced flaws. Comprehensive scanning is essential to proactively identify and remediate these potential security weaknesses before deployment.
- ✗
Enable container escape protection
Why it's wrong here
Container escape protection mechanisms, such as AppArmor or seccomp profiles, are crucial for preventing a compromised container from breaking out of its isolated environment and affecting the host system. However, these protections are primarily reactive, designed to contain an attack *after* a vulnerability within the container has already been exploited. They do not proactively identify or remediate the vulnerabilities *within the container image itself* that could lead to such an initial compromise.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.