School applications accidentally promoted a nonprod image tag into the production pull path. How should artifact registries be organized to reduce that mistake?
Select an answer to reveal the explanation.
Short Explanation
Separate prod and nonprod registries are like separate loading docks—harder to roll the wrong crate onto the live truck. One mutable latest tag invites exactly that mix-up.
Full Explanation
When school applications accidentally promote a nonprod image tag into the production pull path, artifact registries should be organized with separate production and nonproduction registries or repositories. Environment separation makes it harder to point prod at experimental tags and clarifies promotion gates between stages. School-district CI should publish nonprod builds to nonprod repos and only promote approved artifacts into prod repositories that production pull policies may use.
Storing prod and experimental images under one overwriteable latest tag only fails by concept: it maximizes exactly the mix-up described. Deleting all registries and copying images from chat attachments fails controlled artifact management. Allowing unsigned anonymous overwrites of every production digest fails integrity and AuthN/Z on the promote path.
Exam caveat: separation can be separate registries or separate repositories/projects with strong IAM—exams accept environment-separated stores. Pair separation with immutable versioning and promotion approvals for defense in depth.
Operational check: create distinct prod and nonprod repositories for school apps, restrict prod pull credentials to prod repos, require an explicit promote job to copy/sign into prod, ban mutable latest as the sole prod reference, and audit pulls to ensure production never resolves nonprod tags.