Question

A SecDevOps team runs its production workloads as containers built from a hardened base image and deployed through an automated CI/CD pipeline. A critical vulnerability is disclosed in a library baked into the running containers. The security engineer wants a remediation approach that aligns with the team's immutable infrastructure model. Which recommendation best fits this environment?

Accepted Answer

Rebuild the base image with the patched library, push it through the pipeline, and redeploy new containers to replace the running ones

Answer

SSH into each running container and apply the vendor patch manually to minimize downtime

Answer

Configure the running containers to auto-update packages at runtime using a scheduled in-container job

Answer

Apply a host-level firewall rule to block traffic to the vulnerable library and defer patching to the next quarterly release