While reviewing a container image for vulnerabilities, which of the following steps ensures that vulnerabilities in installed software packages are detected and addressed effectively?

Question

Options

• ARelying on the image author's documentation to identify vulnerabilities.
• BChecking for updates to the container orchestration platform.
• CRunning a static analysis scan on the container image.
• DComparing the image against a trusted, verified base image.

• A
  3% (1)
• B
  3% (1)
• C
  87% (34)
• D
  8% (3)

Explanation

Option A: Image authors may provide useful information, but relying solely on their documentation is risky. They might not have updated their documentation with the latest vulnerability information, and the analysis would lack thoroughness. Option B: While keeping the orchestration platform updated is important, this does not address vulnerabilities within the container image itself. The two are separate layers of the container Option C: Static analysis scanning tools are purpose-built to analyze container images for vulnerabilities in installed packages, libraries, and dependencies. They use vulnerability databases (e.g., CVE databases) to identify known issues, enabling you to patch or replace insecure packages before deploying the image. Option D: Comparing images can help identify deviations but does not specifically identify vulnerabilities in installed packages. A static analysis scan is more comprehensive and accurate for this purpose.

No community discussion yet for this question.