hard20 pts · first answer countssupply-chain-securitydevsecopskubernetes

Only deploy images built by CI

Security wants proof that every image running in production was built by your CI from your repo, not pushed by hand. Which design achieves this?

A.Use only the latest tag so every cluster pulls the newest CI build, and block other tags.B.Scan every image with Trivy before deployment and block any image with critical CVEs found.C.Restrict registry push access to the platform team and review the push audit log weekly.D.Sign images with provenance in CI (for example cosign keyless) and verify them in an admission policy.

← Canary on a low-traffic service Policy webhook takes down deploys →