A company that uses containers to run its applications is required to identify vulnerabilities on every container image in a private repository. The security team needs to be able to quickly…

The correct answer is B. Centralized SBoM. A centralized Software Bill of Materials (SBoM) is the best solution for identifying vulnerabilities in container images in a private repository. An SBoM provides a comprehensive inventory of all components, dependencies, and their versions within a container image…

Submitted by omar99· Mar 6, 2026Security Engineering

Question

A company that uses containers to run its applications is required to identify vulnerabilities on every container image in a private repository. The security team needs to be able to quickly evaluate whether to respond to a given vulnerability. Which of the following will allow the security team to achieve the objective with the least effort?

Options

ASAST scan reports
BCentralized SBoM
CCIS benchmark compliance reports
DCredentialed vulnerability scan

How the community answered

(39 responses)

A
3% (1)
B
74% (29)
C
15% (6)
D
8% (3)

Explanation

A centralized Software Bill of Materials (SBoM) is the best solution for identifying vulnerabilities in container images in a private repository. An SBoM provides a comprehensive inventory of all components, dependencies, and their versions within a container image, facilitating quick evaluation and response to vulnerabilities. Why Centralized SBoM? Comprehensive Inventory: An SBoM lists all software components, including their versions and dependencies, allowing for thorough vulnerability assessments. Quick Identification: Centralizing SBoM data enables rapid identification of affected containers when a vulnerability is disclosed. Automation: SBoMs can be integrated into automated tools for continuous monitoring and alerting of vulnerabilities. Regulatory Compliance: Helps in meeting compliance requirements by providing a clear and auditable record of all software components used.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice