Container Image Scanning Vocabulary
Practice vocabulary for container image scanning: CVEs, base image vulnerabilities, scanning tools, distroless images, SBOMs, and image digests.
0 / 41 completed
1 / 41
What is 'container image scanning' in a CI/CD pipeline?
Container image scanning inspects every layer of a built container image — OS packages, language runtimes, libraries — and checks them against CVE (Common Vulnerabilities and Exposures) databases. This happens in CI after the image is built, before it is pushed to a registry or deployed. Tools include Trivy, Grype, Snyk Container, and Clair.
2 / 41
What is a 'base image vulnerability' and why does it matter?
Most container images start FROM a base image (e.g., ubuntu:22.04, node:20-alpine, python:3.12-slim). If the base image contains unpatched CVEs, every image built from it inherits those vulnerabilities. Keeping base images updated and preferring minimal bases (alpine, distroless) reduces the inherited attack surface significantly.
3 / 41
What is a 'distroless' container image?
Distroless images (pioneered by Google) contain only what the application needs to run — no bash, no apt, no curl, no unused libraries. With no shell and no package manager present, an attacker who achieves code execution has far fewer tools available. They also dramatically reduce the number of CVEs present, since fewer packages are installed. Example: gcr.io/distroless/java.
4 / 41
What is the difference between an 'image tag' and an 'image digest'?
Image tags are convenient labels but mutable: pushing a new image with the same tag silently changes what it points to. Image digests are SHA-256 hashes of the image manifest — pinning to a digest (e.g., nginx@sha256:abc...) guarantees you always get exactly the same image, preventing supply-chain attacks where a tag is silently replaced with a malicious image.
5 / 41
What is an SBOM (Software Bill of Materials) for a container image?
An SBOM (Software Bill of Materials) is a machine-readable inventory of all software components in an artefact. For containers, it lists OS packages, language libraries, and their versions. SBOMs enable continuous vulnerability scanning (new CVEs can be checked against existing SBOMs without rebuilding), licence compliance checks, and supply chain audits. Formats include CycloneDX and SPDX. Tools: Syft, Docker Scout, Grype.
6 / 41
Sarah: "Hey team, I've just run a container image scan on the new nginx image before deploying to production. The scan flagged several vulnerabilities in the base image – specifically outdated versions of libcurl and openssl. Should we postpone deployment until these are patched?"This scenario highlights a common workflow. While delaying deployment might seem prudent, simply flagging vulnerabilities isn't enough justification for an immediate halt without further context. The core principle of secure CI/CD involves continuous monitoring and automated remediation, so the best response is to acknowledge the severity and discuss patching strategies rather than immediately blocking deployment; however, postponing deployment *is* a valid approach given the potential impact of outdated components in production.
7 / 41
Mark: "Just ran a scan on the `api-gateway` image. The scanner found a high severity vulnerability in the `python3.9` base image – a known Apache Struts RCE exploit. I've marked it as 'critical' for review, but I'm not sure if we should rollback to the previous version immediately."This scenario highlights the importance of understanding vulnerability severity levels. While 'critical' indicates a serious issue, simply marking it as such doesn't dictate action; a developer needs to assess the potential impact and determine if rollback is truly necessary. The correct response acknowledges that critical vulnerabilities merit immediate attention but emphasizes the need for further investigation to avoid unnecessary disruptions. Ignoring context and blindly following scanner recommendations can lead to overreaction.
8 / 41
John: "I've just submitted a PR to update the `frontend` container image. The scan reports several high-severity vulnerabilities in the underlying Alpine Linux base image – specifically concerning outdated kernel modules. Should I immediately revert my changes and re-scan, or is it acceptable to proceed with a manual security audit before merging?" While automated scans are valuable, high-severity vulnerabilities in base images always warrant careful consideration. Immediately rolling back without investigation could disrupt development; however, the question highlights a crucial step: validating the scanner's findings. A security specialist's verification or a more granular audit is essential to confirm the vulnerability's impact and ensure proper remediation before deploying any changes – ignoring potential false positives can be dangerous.
9 / 41
Mark sent this message in Slack after running a container image scan on the `microservice-a` image:
"The scanner identified a potential vulnerability – a missing or outdated security patch for the `nginx` web server within the image. It's currently marked as 'medium' severity. Should I prioritize applying the patch immediately, even though it requires rebuilding and redeploying the entire microservice?"
The correct answer reflects best practice for security vulnerabilities. While 'medium' severity suggests risk, proactively mitigating potential breaches is crucial. Applying the patch immediately minimizes disruption (option 1 is misleading), prioritizes rapid response (option 2 is accurate), and a thorough understanding of the vulnerability details before action is always recommended (option 3 – deferring without investigation is risky, option 4 is too vague). This approach aligns with a proactive security posture focused on minimizing risk.
10 / 41
Sarah: "Hey team, I've just run a container image scan on the new nginx image before deploying to production. The scan flagged several vulnerabilities in the base image – specifically outdated versions of libcurl and openssl. Should we postpone deployment until these are patched?"This scenario highlights a common workflow. While delaying deployment might seem prudent, simply flagging vulnerabilities isn't enough justification for an immediate halt without further context. The core principle of secure CI/CD involves continuous monitoring and automated remediation, so the best response is to acknowledge the severity and discuss patching strategies rather than immediately blocking deployment; however, postponing deployment *is* a valid approach given the potential impact of outdated components in production.
11 / 41
Mark: "Just ran a scan on the `api-gateway` image. The scanner found a high severity vulnerability in the `python3.9` base image – a known Apache Struts RCE exploit. I've marked it as 'critical' for review, but I'm not sure if we should rollback to the previous version immediately."This scenario highlights the importance of understanding vulnerability severity levels. While 'critical' indicates a serious issue, simply marking it as such doesn't dictate action; a developer needs to assess the potential impact and determine if rollback is truly necessary. The correct response acknowledges that critical vulnerabilities merit immediate attention but emphasizes the need for further investigation to avoid unnecessary disruptions. Ignoring context and blindly following scanner recommendations can lead to overreaction.
12 / 41
John: "I've just submitted a PR to update the `frontend` container image. The scan reports several high-severity vulnerabilities in the underlying Alpine Linux base image – specifically concerning outdated kernel modules. Should I immediately revert my changes and re-scan, or is it acceptable to proceed with a manual security audit before merging?" While automated scans are valuable, high-severity vulnerabilities in base images always warrant careful consideration. Immediately rolling back without investigation could disrupt development; however, the question highlights a crucial step: validating the scanner's findings. A security specialist's verification or a more granular audit is essential to confirm the vulnerability's impact and ensure proper remediation before deploying any changes – ignoring potential false positives can be dangerous.
13 / 41
Mark sent this message in Slack after running a container image scan on the `microservice-a` image:
"The scanner identified a potential vulnerability – a missing or outdated security patch for the `nginx` web server within the image. It's currently marked as 'medium' severity. Should I prioritize applying the patch immediately, even though it requires rebuilding and redeploying the entire microservice?"
The correct answer reflects best practice for security vulnerabilities. While 'medium' severity suggests risk, proactively mitigating potential breaches is crucial. Applying the patch immediately minimizes disruption (option 1 is misleading), prioritizes rapid response (option 2 is accurate), and a thorough understanding of the vulnerability details before action is always recommended (option 3 – deferring without investigation is risky, option 4 is too vague). This approach aligns with a proactive security posture focused on minimizing risk.
14 / 41
Sarah: "Hey team, I've just run a container image scan on the new nginx image before deploying to production. The scan flagged several vulnerabilities in the base image – specifically outdated versions of libcurl and openssl. Should we postpone deployment until these are patched?"This scenario highlights a common workflow. While delaying deployment might seem prudent, simply flagging vulnerabilities isn't enough justification for an immediate halt without further context. The core principle of secure CI/CD involves continuous monitoring and automated remediation, so the best response is to acknowledge the severity and discuss patching strategies rather than immediately blocking deployment; however, postponing deployment *is* a valid approach given the potential impact of outdated components in production.
15 / 41
Mark: "Just ran a scan on the `api-gateway` image. The scanner found a high severity vulnerability in the `python3.9` base image – a known Apache Struts RCE exploit. I've marked it as 'critical' for review, but I'm not sure if we should rollback to the previous version immediately."This scenario highlights the importance of understanding vulnerability severity levels. While 'critical' indicates a serious issue, simply marking it as such doesn't dictate action; a developer needs to assess the potential impact and determine if rollback is truly necessary. The correct response acknowledges that critical vulnerabilities merit immediate attention but emphasizes the need for further investigation to avoid unnecessary disruptions. Ignoring context and blindly following scanner recommendations can lead to overreaction.
16 / 41
John: "I've just submitted a PR to update the `frontend` container image. The scan reports several high-severity vulnerabilities in the underlying Alpine Linux base image – specifically concerning outdated kernel modules. Should I immediately revert my changes and re-scan, or is it acceptable to proceed with a manual security audit before merging?" While automated scans are valuable, high-severity vulnerabilities in base images always warrant careful consideration. Immediately rolling back without investigation could disrupt development; however, the question highlights a crucial step: validating the scanner's findings. A security specialist's verification or a more granular audit is essential to confirm the vulnerability's impact and ensure proper remediation before deploying any changes – ignoring potential false positives can be dangerous.
17 / 41
Mark sent this message in Slack after running a container image scan on the `microservice-a` image:
"The scanner identified a potential vulnerability – a missing or outdated security patch for the `nginx` web server within the image. It's currently marked as 'medium' severity. Should I prioritize applying the patch immediately, even though it requires rebuilding and redeploying the entire microservice?"
The correct answer reflects best practice for security vulnerabilities. While 'medium' severity suggests risk, proactively mitigating potential breaches is crucial. Applying the patch immediately minimizes disruption (option 1 is misleading), prioritizes rapid response (option 2 is accurate), and a thorough understanding of the vulnerability details before action is always recommended (option 3 – deferring without investigation is risky, option 4 is too vague). This approach aligns with a proactive security posture focused on minimizing risk.
18 / 41
Sarah: "Hey team, I've just run a container image scan on the new nginx image before deploying to production. The scan flagged several vulnerabilities in the base image – specifically outdated versions of libcurl and openssl. Should we postpone deployment until these are patched?"This scenario highlights a common workflow. While delaying deployment might seem prudent, simply flagging vulnerabilities isn't enough justification for an immediate halt without further context. The core principle of secure CI/CD involves continuous monitoring and automated remediation, so the best response is to acknowledge the severity and discuss patching strategies rather than immediately blocking deployment; however, postponing deployment *is* a valid approach given the potential impact of outdated components in production.
19 / 41
Mark: "Just ran a scan on the `api-gateway` image. The scanner found a high severity vulnerability in the `python3.9` base image – a known Apache Struts RCE exploit. I've marked it as 'critical' for review, but I'm not sure if we should rollback to the previous version immediately."This scenario highlights the importance of understanding vulnerability severity levels. While 'critical' indicates a serious issue, simply marking it as such doesn't dictate action; a developer needs to assess the potential impact and determine if rollback is truly necessary. The correct response acknowledges that critical vulnerabilities merit immediate attention but emphasizes the need for further investigation to avoid unnecessary disruptions. Ignoring context and blindly following scanner recommendations can lead to overreaction.
20 / 41
John: "I've just submitted a PR to update the `frontend` container image. The scan reports several high-severity vulnerabilities in the underlying Alpine Linux base image – specifically concerning outdated kernel modules. Should I immediately revert my changes and re-scan, or is it acceptable to proceed with a manual security audit before merging?" While automated scans are valuable, high-severity vulnerabilities in base images always warrant careful consideration. Immediately rolling back without investigation could disrupt development; however, the question highlights a crucial step: validating the scanner's findings. A security specialist's verification or a more granular audit is essential to confirm the vulnerability's impact and ensure proper remediation before deploying any changes – ignoring potential false positives can be dangerous.
21 / 41
Mark sent this message in Slack after running a container image scan on the `microservice-a` image:
"The scanner identified a potential vulnerability – a missing or outdated security patch for the `nginx` web server within the image. It's currently marked as 'medium' severity. Should I prioritize applying the patch immediately, even though it requires rebuilding and redeploying the entire microservice?"
The correct answer reflects best practice for security vulnerabilities. While 'medium' severity suggests risk, proactively mitigating potential breaches is crucial. Applying the patch immediately minimizes disruption (option 1 is misleading), prioritizes rapid response (option 2 is accurate), and a thorough understanding of the vulnerability details before action is always recommended (option 3 – deferring without investigation is risky, option 4 is too vague). This approach aligns with a proactive security posture focused on minimizing risk.
22 / 41
Mark commented on a code review: "This container image scan flagged a high-severity vulnerability in the `Node.js` base image – specifically an outdated version of Express.js. I've added a comment requesting that we update this dependency before deploying to production. Does anyone have experience with mitigating vulnerabilities in Node.js images?"
This question tests understanding of a common code review scenario related to container image scanning. The key is recognizing that 'high-severity' vulnerabilities, particularly those in widely used libraries like Express.js, demand prompt attention. The incorrect options misinterpret the urgency or suggest alternative priorities that aren't standard best practices.
23 / 41
"Alex: 'Our automated scan of the `database-service` image returned a warning about an outdated version of PostgreSQL. The scanner suggests applying patch level 12.3 to address CVE-2023-12345. Should we investigate this further before merging the PR?'"
This question focuses on Slack communication and proactive vulnerability management. The phrase 'suggests applying patch level' indicates a specific remediation step that requires attention. The incorrect options fail to grasp this nuance—treating scanner warnings as automatically critical or dismissing them without investigation is a risky approach.
24 / 41
{
"image": "web-app",
"scan_results": [
{
"vulnerability": "Outdated libssl",
"severity": "high",
"cve": "CVE-2023-4567",
"recommendation": "Upgrade to version 1.1.1"
}
]
}This question simulates receiving an API response from a container image scanning tool. The crucial element is understanding that the API provides key details (vulnerability type, severity, CVE ID, and recommended fix). The wrong options misinterpret the purpose of such a response or focus on irrelevant aspects.
25 / 41
"PR Description: 'Updated the `backend` container image to include the latest security patches. The scan identified and addressed vulnerabilities in the base Ubuntu image, specifically outdated versions of Apache HTTPD and PHP. This PR also includes a new dependency on libxml2 for improved performance.'
This scenario tests the ability to interpret a PR description. A good PR description clearly states *what* was changed (image update), *why* (security patches), and *which* vulnerabilities were addressed. The incorrect options demonstrate a misunderstanding of what information is essential in a PR description for container image updates.
26 / 41
"Sarah: 'During my morning stand-up, I ran a scan on the new `reporting` container image. The scanner found a critical vulnerability – an outdated version of Python 3.8 with a known security flaw. I'm currently investigating potential fixes and will update the team as soon as possible.'"
This question assesses communication skills in a stand-up setting. The key is that Sarah immediately identifies and communicates a critical vulnerability, outlining her immediate actions. The incorrect options highlight a failure to prioritize clear and concise information sharing – crucial for timely issue resolution.
27 / 41
Mark commented on a code review: "This container image scan flagged a high-severity vulnerability in the `Node.js` base image – specifically an outdated version of Express.js. I've added a comment requesting that we update this dependency before deploying to production. Does anyone have experience with mitigating vulnerabilities in Node.js images?"
This question tests understanding of a common code review scenario related to container image scanning. The key is recognizing that 'high-severity' vulnerabilities, particularly those in widely used libraries like Express.js, demand prompt attention. The incorrect options misinterpret the urgency or suggest alternative priorities that aren't standard best practices.
28 / 41
"Alex: 'Our automated scan of the `database-service` image returned a warning about an outdated version of PostgreSQL. The scanner suggests applying patch level 12.3 to address CVE-2023-12345. Should we investigate this further before merging the PR?'"
This question focuses on Slack communication and proactive vulnerability management. The phrase 'suggests applying patch level' indicates a specific remediation step that requires attention. The incorrect options fail to grasp this nuance—treating scanner warnings as automatically critical or dismissing them without investigation is a risky approach.
29 / 41
{
"image": "web-app",
"scan_results": [
{
"vulnerability": "Outdated libssl",
"severity": "high",
"cve": "CVE-2023-4567",
"recommendation": "Upgrade to version 1.1.1"
}
]
}This question simulates receiving an API response from a container image scanning tool. The crucial element is understanding that the API provides key details (vulnerability type, severity, CVE ID, and recommended fix). The wrong options misinterpret the purpose of such a response or focus on irrelevant aspects.
30 / 41
"PR Description: 'Updated the `backend` container image to include the latest security patches. The scan identified and addressed vulnerabilities in the base Ubuntu image, specifically outdated versions of Apache HTTPD and PHP. This PR also includes a new dependency on libxml2 for improved performance.'
This scenario tests the ability to interpret a PR description. A good PR description clearly states *what* was changed (image update), *why* (security patches), and *which* vulnerabilities were addressed. The incorrect options demonstrate a misunderstanding of what information is essential in a PR description for container image updates.
31 / 41
"Sarah: 'During my morning stand-up, I ran a scan on the new `reporting` container image. The scanner found a critical vulnerability – an outdated version of Python 3.8 with a known security flaw. I'm currently investigating potential fixes and will update the team as soon as possible.'"
This question assesses communication skills in a stand-up setting. The key is that Sarah immediately identifies and communicates a critical vulnerability, outlining her immediate actions. The incorrect options highlight a failure to prioritize clear and concise information sharing – crucial for timely issue resolution.
32 / 41
Mark commented on a code review: "This container image scan flagged a high-severity vulnerability in the `Node.js` base image – specifically an outdated version of Express.js. I've added a comment requesting that we update this dependency before deploying to production. Does anyone have experience with mitigating vulnerabilities in Node.js images?"
This question tests understanding of a common code review scenario related to container image scanning. The key is recognizing that 'high-severity' vulnerabilities, particularly those in widely used libraries like Express.js, demand prompt attention. The incorrect options misinterpret the urgency or suggest alternative priorities that aren't standard best practices.
33 / 41
"Alex: 'Our automated scan of the `database-service` image returned a warning about an outdated version of PostgreSQL. The scanner suggests applying patch level 12.3 to address CVE-2023-12345. Should we investigate this further before merging the PR?'"
This question focuses on Slack communication and proactive vulnerability management. The phrase 'suggests applying patch level' indicates a specific remediation step that requires attention. The incorrect options fail to grasp this nuance—treating scanner warnings as automatically critical or dismissing them without investigation is a risky approach.
34 / 41
{
"image": "web-app",
"scan_results": [
{
"vulnerability": "Outdated libssl",
"severity": "high",
"cve": "CVE-2023-4567",
"recommendation": "Upgrade to version 1.1.1"
}
]
}This question simulates receiving an API response from a container image scanning tool. The crucial element is understanding that the API provides key details (vulnerability type, severity, CVE ID, and recommended fix). The wrong options misinterpret the purpose of such a response or focus on irrelevant aspects.
35 / 41
"PR Description: 'Updated the `backend` container image to include the latest security patches. The scan identified and addressed vulnerabilities in the base Ubuntu image, specifically outdated versions of Apache HTTPD and PHP. This PR also includes a new dependency on libxml2 for improved performance.'
This scenario tests the ability to interpret a PR description. A good PR description clearly states *what* was changed (image update), *why* (security patches), and *which* vulnerabilities were addressed. The incorrect options demonstrate a misunderstanding of what information is essential in a PR description for container image updates.
36 / 41
"Sarah: 'During my morning stand-up, I ran a scan on the new `reporting` container image. The scanner found a critical vulnerability – an outdated version of Python 3.8 with a known security flaw. I'm currently investigating potential fixes and will update the team as soon as possible.'"
This question assesses communication skills in a stand-up setting. The key is that Sarah immediately identifies and communicates a critical vulnerability, outlining her immediate actions. The incorrect options highlight a failure to prioritize clear and concise information sharing – crucial for timely issue resolution.
37 / 41
Mark commented on a code review: "This container image scan flagged a high-severity vulnerability in the `Node.js` base image – specifically an outdated version of Express.js. I've added a comment requesting that we update this dependency before deploying to production. Does anyone have experience with mitigating vulnerabilities in Node.js images?"
This question tests understanding of a common code review scenario related to container image scanning. The key is recognizing that 'high-severity' vulnerabilities, particularly those in widely used libraries like Express.js, demand prompt attention. The incorrect options misinterpret the urgency or suggest alternative priorities that aren't standard best practices.
38 / 41
"Alex: 'Our automated scan of the `database-service` image returned a warning about an outdated version of PostgreSQL. The scanner suggests applying patch level 12.3 to address CVE-2023-12345. Should we investigate this further before merging the PR?'"
This question focuses on Slack communication and proactive vulnerability management. The phrase 'suggests applying patch level' indicates a specific remediation step that requires attention. The incorrect options fail to grasp this nuance—treating scanner warnings as automatically critical or dismissing them without investigation is a risky approach.
39 / 41
{
"image": "web-app",
"scan_results": [
{
"vulnerability": "Outdated libssl",
"severity": "high",
"cve": "CVE-2023-4567",
"recommendation": "Upgrade to version 1.1.1"
}
]
}This question simulates receiving an API response from a container image scanning tool. The crucial element is understanding that the API provides key details (vulnerability type, severity, CVE ID, and recommended fix). The wrong options misinterpret the purpose of such a response or focus on irrelevant aspects.
40 / 41
"PR Description: 'Updated the `backend` container image to include the latest security patches. The scan identified and addressed vulnerabilities in the base Ubuntu image, specifically outdated versions of Apache HTTPD and PHP. This PR also includes a new dependency on libxml2 for improved performance.'
This scenario tests the ability to interpret a PR description. A good PR description clearly states *what* was changed (image update), *why* (security patches), and *which* vulnerabilities were addressed. The incorrect options demonstrate a misunderstanding of what information is essential in a PR description for container image updates.
41 / 41
"Sarah: 'During my morning stand-up, I ran a scan on the new `reporting` container image. The scanner found a critical vulnerability – an outdated version of Python 3.8 with a known security flaw. I'm currently investigating potential fixes and will update the team as soon as possible.'"
This question assesses communication skills in a stand-up setting. The key is that Sarah immediately identifies and communicates a critical vulnerability, outlining her immediate actions. The incorrect options highlight a failure to prioritize clear and concise information sharing – crucial for timely issue resolution.
Frequently Asked Questions
What does the "Container Image Scanning Vocabulary" exercise cover?
Practice vocabulary for container image scanning: CVEs, base image vulnerabilities, scanning tools, distroless images, SBOMs, and image digests.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Container Image Scanning Vocabulary"?
This exercise has 41 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Devsecops Pipeline Language exercises?
Browse the full Devsecops Pipeline Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.