3.2 Given a Use Case, Recommend an Image Assessment Policy and Exclusions CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A team uses a custom base image that includes a known vulnerability in a development tool that is not used in production. What exclusion would be appropriate for this image assessment policy?

   • AExclude the specific vulnerability in the development tool for non-production environments
   • BExclude all vulnerabilities in the image
   • CExclude the entire image from all scanning
   • DExclude the image from scanning only in production
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise is adopting a strict image assessment policy that fails on any high-severity vulnerability. However, a critical internal application uses a base image that has a high-severity vulnerability in a component that is not used at runtime. The vulnerability cannot be patched without a major refactor. The team needs to pass assessment to meet a compliance deadline. What is the best course of action?

   • ALower the assessment threshold to ignore high-severity vulnerabilities for all images.
   • BCreate an exclusion for the specific vulnerability in that image, with a documented risk acceptance and a remediation plan.
   • CRefuse to allow the image into production until it is patched.
   • DExclude the entire image from assessment to meet the deadline.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A multinational company operates in regions with different data privacy regulations. They have a single container registry that serves both regions. One region requires strict assessment with no exclusions for high-severity vulnerabilities, while the other allows exclusions with documented risk acceptance. How should they configure image assessment?

   • ADisable assessment for the region that allows exclusions to reduce overhead.
   • BUse the strictest policy for both regions to ensure compliance everywhere.
   • CUse separate assessment policies for each region, tailored to the respective regulatory requirements.
   • DUse a single policy that allows exclusions with documentation, as it is the most flexible.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is required by a client to provide evidence that all container images in production have been assessed for vulnerabilities. They currently have a policy that only fails on critical vulnerabilities. The client requires that high-severity vulnerabilities be remediated or formally accepted. What should the company do?

   • AKeep the current policy and provide the client with a list of critical vulnerabilities.
   • BDisable assessment for images that are not directly exposed to the internet.
   • CUpdate the policy to fail on high-severity vulnerabilities and create a process for formal acceptance of any exceptions.
   • DCreate exclusions for all high-severity vulnerabilities to avoid the need for remediation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the main trade-off when adding exclusions to an image assessment policy?

   • AReduced scanning time but increased cost
   • BImproved compliance but slower performance
   • CBetter visibility but more false positives
   • DIncreased flexibility for deployments but potentially increased security risk
   Reveal Solution Discussion Select an answer first