An image containing medium vulnerabilities that do not have available fixes is being deployed into the sock-shop namespace. Prisma Cloud has been configured for vulnerability management within the…

Question

Options

• AThe image will pass the CI policy, but will be blocked by the deployed policy; therefore, it will not
• BThe CI policy will fail the build; therefore, the image will not be deployed.
• CThe image will be deployed successfully, and all vulnerabilities will be reported.
• DThe image will be deployed successfully, but no vulnerabilities will be reported.

• A
  26% (12)
• B
  50% (23)
• C
  15% (7)
• D
  9% (4)

Explanation

Option B is correct because Prisma Cloud's CI policy enforces vulnerability thresholds at build time - when medium vulnerabilities (even without available fixes) exceed the configured severity threshold, the CI tool fails the build and prevents the image from ever being pushed to the registry or deployed. Option A is wrong because the block doesn't happen at the namespace/runtime level; the image never makes it past CI. Option C is wrong because Prisma Cloud's policy is not merely observational - it actively gates the pipeline rather than silently permitting deployments. Option D is wrong for the same reason, and additionally, Prisma Cloud always reports vulnerabilities regardless of policy outcome.

Memory tip: Think of CI policy as a gatekeeper at the factory door - if the product fails inspection, it never ships, regardless of whether a "fix" exists for the defect. The unfixable status of a vulnerability does not exempt it from failing a policy threshold; it only affects remediation options, not enforcement.

No community discussion yet for this question.