Question

A DevSecOps team builds Docker images that are pushed to a private registry before deployment into a Kubernetes cluster. Recently, a production workload was found running an image containing a critical CVE in a bundled OS library. The security architect wants to prevent vulnerable images from ever reaching the cluster while keeping the CI/CD pipeline automated. Which control best addresses this requirement?

Accepted Answer

Integrate automated container image vulnerability scanning at the registry/build stage and fail the pipeline when critical CVEs are detected

Answer

Enable runtime process anomaly detection on the Kubernetes worker nodes to alert when the vulnerable library is executed

Answer

Deploy a network firewall in front of the cluster to block inbound exploit traffic targeting the vulnerable library

Answer

Configure Kubernetes network policies to isolate the affected pod from east-west traffic within the namespace