2V0-71.23 Question 354
Select 3Your organization uses VMware Tanzu to manage containerized applications. As part of your security policies, you are tasked with configuring image registry scanning to identify and block images with critical CVEs. Which steps must you take to ensure that images with critical vulnerabilities are not used in your Kubernetes cluster?
- A
Enable image scanning in the container registry and configure it to detect CVEs.
- B
Integrate the container registry with a policy engine to enforce blocking rules for critical CVEs.
- C
Manually delete images with critical CVEs from the container registry.
- D
Configure Kubernetes Admission Controllers to block deployments of images with critical CVEs.
- E
Disable image scanning to allow Kubernetes to handle CVE detection natively.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure that images with critical CVEs are blocked, it is necessary to enable image scanning in the container registry to detect vulnerabilities, integrate with a policy engine to enforce blocking rules, and use Kubernetes Admission Controllers to prevent the deployment of vulnerable images. These steps collectively provide a robust approach to identifying and mitigating critical CVEs in container images.
- A. Correct.
Enabling image scanning in the container registry is a critical first step to detect vulnerabilities, including CVEs, in container images.
- B. Correct.
Integrating the registry with a policy engine allows automated enforcement of rules, such as preventing images with critical CVEs from being used.
- C. Incorrect.
While manually deleting images with critical CVEs could be a temporary measure, it is not scalable or automated, making it an inefficient solution.
- D. Correct.
Configuring Kubernetes Admission Controllers ensures that images with critical CVEs are blocked at the deployment stage, providing an additional layer of enforcement.
- E. Incorrect.
Disabling image scanning entirely is counterproductive as Kubernetes does not natively handle CVE detection, and it would leave your environment vulnerable.