A security engineer is designing an automated DevSecOps workflow to manage vulnerability triage, gating, and remediation for container workloads across CI/CD pipelines and registry environments. The organization has established the following operational requirements: Automatically trigger Common Vulnerabilities and Exposures (CVE) security scans immediately when newly built container images are pushed to the registry. Enforce automated deployment guardrails by preventing any container images with vulnerability severities meeting or exceeding the High threshold from being pulled by runtime environments. Implement automated workflows to triage findings, trigger ticketing playbooks for base image patching, and establish cleanup lifecycle policies for vulnerable or stale artifacts. Which configuration strategy should the security engineer implement?

Configure registry project settings to enable 'Automatically scan images on push', activate 'Prevent vulnerable images from running' with a 'High' severity threshold, and integrate scan event webhooks with SOAR automation playbooks and tag retention policies.: ### What Automated Registry Scanning and Policy Enforcement Is Automating container image scanning upon push and enforcing runtime pull restrictions within the artifact repository creates an inline security perimeter. This ensures that any container image artifact produced by the continuous integration and delivery (CI/CD) pipeline is evaluated for known Common Vulnerabilities and Exposures (**CVEs**) before runtime environments or deployment systems can pull and instantiate the workload. ### How It Meets the Requirements - **Automatic vulnerability scanning on push**: Enabling **Automatically scan images on push** ensures that as soon as a build step pushes an artifact into the registry project, a comprehensive CVE scanner executes without requiring manual triggers or external polling. - **Preventing deployment of vulnerable artifacts**: Enabling **Prevent vulnerable images from running** and selecting the **High** severity threshold guarantees that runtime clusters cannot pull any image containing vulnerabilities equal to or higher than **High**. - **Automated triage and remediation**: Emitting registry webhook events to Security Orchestration, Automation, and Response (**SOAR**) systems enables automated ticketing for base image patching and links with tag retention rules to purge stale, vulnerable image tags. ### Key Advantages and Capabilities - **Immediate Shift-Left Feedback**: Developers receive immediate CVE reports upon pipeline execution, identifying vulnerable third-party dependencies and base OS packages. - **Deterministic Runtime Protection**: Blocks vulnerable images at the repository layer, preventing unauthorized deployments even if deployment manifests bypass CI pipeline checks. - **Orchestrated Remediation**: SOAR playbooks parse scanner outputs to file prioritized tickets with actionable patching guidance (e.g., updating upstream base image versions). - **Lifecycle Maintenance**: Tag retention rules automatically deprecate and prune unpatched or redundant artifact versions. ### Why This Is Optimal This approach combines native registry guardrails with automated triage and lifecycle controls, providing preventative enforcement and automated remediation workflows without introducing manual bottlenecks into the software release cycle.

Automated Vulnerability Triage Remediation Pipeline | Professional Cloud Security Engineer

Automated Vulnerability Triage Remediation Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing an automated DevSecOps workflow to manage vulnerability triage, gating, and remediation for container workloads across CI/CD pipelines and registry environments. The organization has established the following operational requirements:

Automatically trigger Common Vulnerabilities and Exposures (CVE) security scans immediately when newly built container images are pushed to the registry.
Enforce automated deployment guardrails by preventing any container images with vulnerability severities meeting or exceeding the High threshold from being pulled by runtime environments.
Implement automated workflows to triage findings, trigger ticketing playbooks for base image patching, and establish cleanup lifecycle policies for vulnerable or stale artifacts.

Which configuration strategy should the security engineer implement?

Configure post-deployment vulnerability scanning via cron jobs, disable registry pull restrictions to avoid deployment latency, and write custom scripts to parse logs and send direct chat notifications to developers.

Set the registry pull prevention threshold to 'Negligible' severity, require mandatory pull-request approvals from all repository owners, and rely solely on developers to manually run local vulnerability scans.

Configure registry project settings to enable 'Automatically scan images on push', activate 'Prevent vulnerable images from running' with a 'High' severity threshold, and integrate scan event webhooks with SOAR automation playbooks and tag retention policies.

Configure registry project settings with scheduled monthly scans, grant developers administrative roles to override pull blocks, and disable tag retention rules to preserve all historical images permanently.

Professional Cloud Security Engineer

Automated Vulnerability Triage Remediation Pipeline

Related questions