2V0-71.23 Question 351
Select 3Your organization uses VMware Tanzu to manage containerized workloads and has implemented a container registry integrated with Tanzu. The security team requires that container images with known critical CVEs (Common Vulnerabilities and Exposures) be blocked from deployment into production. Additionally, the team wants to ensure that a policy is in place to scan images regularly for updated CVE data. Which steps should you take to meet these requirements?
- A
Configure a registry scanning policy in Tanzu to block images with critical CVEs from being deployed.
- B
Integrate the container registry with a third-party vulnerability scanning tool and schedule periodic scans.
- C
Enable image signing and enforce a policy to allow only signed images in production.
- D
Set up a Tanzu policy that allows deployments even if critical CVEs are found, but logs them for later review.
- E
Use Tanzu Mission Control to enforce policies that restrict workloads using images flagged with critical CVEs.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the organization's requirement to block images with critical CVEs and ensure continuous scanning, you need to configure registry scanning policies, integrate with third-party vulnerability scanning tools, and enforce policies using tools like Tanzu Mission Control. These steps collectively ensure that images are scanned, vulnerabilities are identified, and deployments are blocked if critical issues are detected.
- A. Correct.
Correct: Configuring a registry scanning policy in Tanzu ensures that images are scanned for CVEs and blocks images with critical CVEs from being deployed. This directly addresses the security team's requirements.
- B. Correct.
Correct: Integrating the registry with a third-party vulnerability scanning tool and scheduling scans ensures continuous monitoring for vulnerabilities, helping to keep CVE data up-to-date.
- C. Incorrect.
Incorrect: While image signing is a good security practice, it does not address scanning for CVEs or blocking images with critical vulnerabilities.
- D. Incorrect.
Incorrect: Allowing deployments of images with critical CVEs and only logging them does not meet the requirement to block such images from being deployed.
- E. Correct.
Correct: Tanzu Mission Control can enforce policies that restrict the use of images flagged with critical CVEs, providing another layer of security enforcement.