Fire/EMS CI scans a container base image and finds a critical CVE. What should the pipeline do?
Select an answer to reveal the explanation.
Short Explanation
A critical CVE on the EMS base image is a red tag on the ambulance kit—CI should stop the line, not floor it into production. Suppressing or deleting the scanner just hides the warning light.
Full Explanation
Security scanning enhancements should fail CI when a critical base-image CVE violates policy until the finding is remediated or formally excepted. Fire/EMS pipelines that scan a container base image and discover a critical CVE must block promotion rather than shipping the vulnerable foundation under emergency-services workloads. The correct response works because base images underlie every derived service container; a critical CVE there is inherited broadly, and failing the pipeline forces a rebuild on a patched base or an explicit, time-bounded exception with ownership.
Promoting the image to production faster to "outpace" the vulnerability fails because speed does not remove the CVE—it only shortens the window before exploitability meets production Fire/EMS systems. Suppressing the finding permanently without remediation or exception review fails conceptually: permanent silent suppression converts scanning into theater and leaves no audit trail for why risk was accepted. Deleting the scanner configuration and continuing as if no CVE existed fails because removing detection guarantees the next critical finding is also invisible.
Exam caveat: distinguish base-image CVEs with available fixes from those without upstream patches; policy may allow time-boxed exceptions with compensating controls, but "forever suppress" is not that process. Operational check: scan the Fire/EMS base image in CI, inject or use a known critical finding in a non-prod pipeline, confirm promotion blocks, remediate by moving to a patched base digest, and retain the scan report with the build for compliance evidence.