Question

A DevOps team deploys containerized microservices to a managed Kubernetes cluster. During a recent security review, auditors discovered that several running containers were built from base images containing known critical CVEs. The team wants to prevent vulnerable images from ever reaching production while minimizing manual effort. Which control BEST addresses this requirement?

Accepted Answer

Integrate automated image vulnerability scanning into the CI/CD pipeline and configure the registry to block images that fail policy thresholds

Answer

Enable network segmentation between namespaces so compromised containers cannot reach other workloads

Answer

Require MFA for all developers pushing images to the container registry

Answer

Deploy a runtime intrusion detection agent to each node to alert on suspicious container behavior