Is vulnerability analysis against images in the registry sufficient for security?

Question

Options

• AYes, containers do not have unique vulnerabilities.
• BNo, you should do vulnerability analysis only against the running containers, which are
• CYes, you are ensuring that the images the containers are based on are secure.
• DNo, you need to do analysis in the CI system, in the registry, and against instantiated

• A
  5% (2)
• B
  14% (5)
• C
  78% (29)
• D
  3% (1)

Explanation

Scanning images in the registry is sufficient because containers are directly instantiated from those images - if the image is clean, the container built from it inherits that security posture. Registry scanning acts as a security gate before any image is ever deployed, catching known CVEs in the base OS, libraries, and application layers at the artifact level.

Why the distractors are wrong:

• A is incorrect because containers can have unique vulnerabilities depending on configuration, runtime settings, and the specific packages included in the image - not all containers are equally vulnerable.
• B is wrong because limiting scanning to only running containers misses the pre-deployment opportunity; by the time a container is running, a vulnerable image has already entered your environment.
• D is wrong in the context of this question because it implies registry scanning alone is insufficient and demands CI + registry + runtime analysis - while that's a defense-in-depth ideal, the exam is testing whether registry scanning is adequate as a baseline, which it is.

Memory tip: Think of the registry as a security checkpoint at the door - you inspect packages before they enter the building. If the image (the blueprint) is secure, every container (the building) made from it is secure too.

No community discussion yet for this question.