Docker and CI/CD · Senior · Question 61 of 75
Your scanner reports 40 CVEs, 30 with no fix available. What's a sensible policy?
- ✓Correct answer: Fail on fixable high-severity issues; track the rest
- 2Block every deploy until all 40 CVEs are fixed
- 3Turn off scanning, since unfixable CVEs are noise
Explanation
Gating on unfixable issues blocks everything and teaches people to bypass the gate. Prioritize by severity, fix availability and whether the code path is reachable.