Kcna Kubernetes And Cloud Native Associate · Free Practice Question Medium
Question 41
You are required to ensure that all running containers in your Kubernetes cluster are scanned for vulnerabilities. Which of the following methods would be the most suitable to achieve this?
-
A
Use a post-start lifecycle hook to trigger a vulnerability scan on each container.
-
B
Implement a Kubernetes Operator that periodically scans all running containers.
-
C
Integrate a third-party container scanning tool into your CI/CD pipeline.
-
D
Configure Kubelet to run vulnerability scans on each node.
Reveal correct answer
Correct answer: C
A.
Using post-start lifecycle hooks would require manual effort for each pod and wouldn't prevent vulnerable containers from running.
B.
An Operator would be reactive rather than proactive, allowing potentially vulnerable containers to be deployed before being scanned.
C.
Scanning containers before they are deployed is the most effective way to prevent vulnerabilities. Integrating a third-party tool into the CI/CD pipeline would ensure all containers are scanned before they reach the cluster.
D.
Kubelet is not designed to perform vulnerability scans.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
