3.2 Given a Use Case, Recommend an Image Assessment Policy and Exclusions CCCS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of an image assessment policy in a cloud security context?

   • ATo manage access control for cloud storage buckets
   • BTo automatically patch vulnerabilities in running cloud workloads
   • CTo monitor network traffic between cloud services
   • DTo define rules for scanning container and VM images for vulnerabilities and compliance issues before deployment
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A software company runs a mix of production and development environments in the cloud. They want to enforce a strict image assessment policy for production, but for development they want to allow faster iteration with fewer blockers. What is the best approach?

   • AUse a single policy but exclude all development images from assessment.
   • BUse separate assessment policies for production and development environments.
   • CApply the same strict policy to all environments to ensure consistency.
   • DDisable assessment for development environments entirely.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security team needs to assess images used for a public-facing web application that handles credit card data. Which image assessment policy approach is most appropriate for this use case?

   • AA policy that excludes all compliance checks to avoid false positives
   • BA policy that scans for common vulnerabilities only
   • CA policy that only checks for malware in images
   • DA policy that includes compliance checks for PCI DSS and scans for critical vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which factor is most important when selecting an image assessment policy for a workload that processes healthcare data?

   • AThe number of developers on the team
   • BThe cloud provider's region
   • CThe compliance requirements, such as HIPAA
   • DThe cost of the scanning tool
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup wants to move quickly and deploy container images frequently. They have a policy that fails on any vulnerability, but they find that many low-severity issues are not relevant to their environment. They want to reduce friction without compromising security. What is the best approach?

   • ACreate a blanket exclusion for all low-severity vulnerabilities across all images.
   • BKeep the policy as is and require developers to manually approve each low-severity vulnerability.
   • CDisable assessment for development images and only assess production images.
   • DAdjust the policy to fail on high-severity vulnerabilities and create exclusions for specific low-severity issues that are not exploitable.
   Reveal Solution Discussion Select an answer first