mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A company uses Docker containers for microservices
A company uses Docker containers for microservices. What is the most important security measure for container images?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use minimal base images and scan them for vulnerabilities
Minimal base images reduce attack surface, and vulnerability scanning detects known issues. Option B is wrong because using 'latest' tags can cause inconsistent builds. Option C is wrong because hardcoding secrets is never recommended. Option D is wrong because running as root is insecure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use minimal base images and scan them for vulnerabilities
Why this is correct
Using minimal base images significantly reduces the attack surface by including only essential components, thereby limiting potential vulnerabilities from unnecessary software packages or services. Regularly scanning these images for vulnerabilities, often through tools like Clair or Trivy, is critical to identify and remediate known Common Vulnerabilities and Exposures (CVEs) before deployment. This proactive approach ensures that the deployed microservices are built upon a secure and well-vetted foundation, minimizing exposure to exploits.
- ✗
Use the latest version of base image to ensure patches
Why it's wrong here
Relying on the "latest" tag for base images is problematic because it lacks reproducibility and stability, as the underlying image content can change unpredictably. While it might seem to ensure patches, it can introduce new, untested vulnerabilities or breaking changes without warning, making rollbacks or consistent deployments difficult. Instead, using specific, immutable version tags (e.g., ubuntu:22.04 or node:18-alpine) is a best practice for predictable and secure container builds.
- ✗
Hardcode secrets into the image
Why it's wrong here
Hardcoding secrets directly into a Docker image is a severe security misconfiguration that makes sensitive information, such as API keys or database credentials, permanently part of the image layer. This means anyone with access to the image can easily extract these secrets, leading to potential compromise if the image is ever leaked or stored insecurely. Best practices dictate using external secret management solutions like Kubernetes Secrets, Docker Secrets, or HashiCorp Vault, injecting them at runtime.
- ✗
Run containers as root for easier privilege management
Why it's wrong here
Running containers as the root user inside the container is a significant security risk, violating the principle of least privilege. If a container is compromised while running as root, an attacker gains elevated privileges within the container, increasing the likelihood of a container escape and potential compromise of the host system. It is always recommended to define a non-root user in the Dockerfile and run processes with the lowest necessary privileges to mitigate this risk.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.