What are two reasons a Docker golden image should be updated? (Choose two.)

Changes to Docker secrets (usernames/passwords) are typically managed outside the image itself, often mounted as files or environment variables at runtime, and do not necessitate a rebuild of the golden image.

While a new application release often requires an update, 'security vulnerability fix' and 'base image end of life' are more fundamental reasons for updating a foundational or golden image.

Security vulnerabilities can compromise the container and the host system, so incorporating fixes as soon as they are available by updating the golden image is a critical security practice.

Changes to environment variables in a Dockerfile would trigger an image rebuild, but this is a specific configuration change rather than a fundamental driver for updating a 'golden image' like security or underlying support.

When a base image is nearing its end of life, it will no longer receive security updates or support, making it essential to update the golden image to use a newer, supported base image to maintain security and stability.