Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security engineer is designing an automated DevSecOps workflow to manage vulnerability triage, gating, and remediation for container workloads across CI/CD pipelines and registry environments. The organization has established the following operational requirements:
Which configuration strategy should the security engineer implement?
This configuration defers vulnerability detection until after containers are already executing in production, relying on asynchronous batch scripts and chat alerts rather than preventative registry admission controls and automated ticketing integrations.
The organization had no requirement to block deployments, lacked registry-level controls, and only required periodic compliance reporting on existing live workloads.
Effective CI/CD security requires preventative controls at the registry layer before runtime instantiation to avoid having to perform high-stress live rollbacks.
This approach configures periodic batch scanning on a monthly interval, allows developers broad administrative privileges to bypass security controls, and disables artifact retention policies to keep every image tag indefinitely.
ProjectAdmin roles allows bypass of pull blocks, compromising automated governance and separation of duties.The organization was designing a cold-storage immutable archive for forensic data where active workloads are not deployed and scans are run on an ad-hoc audit schedule.
Automated tag retention rules are essential in DevSecOps to maintain hygiene by automatically retiring and removing vulnerable, unmaintained container artifacts.
This strategy attempts to enforce maximum restriction by selecting a Negligible threshold in registry settings while relying on manual developer scans and universal branch merge approvals.
The scenario required decentralized peer code review processes without centralized build or container registry governance.
Vulnerability management frameworks focus gating policies on actionable severity thresholds (such as High and Critical) while automating scans centrally within the pipeline.
Automating container image scanning upon push and enforcing runtime pull restrictions within the artifact repository creates an inline security perimeter. This ensures that any container image artifact produced by the continuous integration and delivery (CI/CD) pipeline is evaluated for known Common Vulnerabilities and Exposures (CVEs) before runtime environments or deployment systems can pull and instantiate the workload.
This approach combines native registry guardrails with automated triage and lifecycle controls, providing preventative enforcement and automated remediation workflows without introducing manual bottlenecks into the software release cycle.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated