After a CVE patch, 311 serving must pick up an updated NGC TensorRT container at runtime. What fits?
Select an answer to reveal the explanation.
Short Explanation
After the CVE patch, pull the updated NGC TensorRT into the 311 serving neighborhood—fresh container, same civic curb. Keeping the vulnerable image forever is how audits fail.
Full Explanation
Deploying the updated NGC TensorRT container into the municipal 311 serving namespace fits post-CVE remediation because runtime serving must actually run the patched image. NGC provides NVIDIA's curated TensorRT containers; promoting the updated tag into the 311 serving deployment (or equivalent Run:ai/K8s workload) replaces the vulnerable runtime while preserving the serving path residents depend on.
Keeping the vulnerable image forever and only updating documentation fails by remediation completeness: docs do not patch CVEs in running containers. Building a random untrusted image from an unknown mirror with no NGC source fails by supply-chain trust—CVE response is the wrong time to abandon curated provenance. Removing GPU access from serving so the CVE image can stay unchanged fails by availability and avoidance: denying GPUs does not remediate the image and may break 311 inference.
Exam caveat: update the serving workload's image reference and roll out safely (surge/readiness probes), and keep prior tags available for rollback if the new TensorRT build misbehaves. The correct action is deploying the updated NGC container—not paperwork-only or untrusted mirrors.
Operational check: pull the patched NGC TensorRT tag into the civic registry if mirroring, update the 311 serving manifest/namespace deployment, verify pods run the new digest, re-test inference, and close the CVE with evidence of the running image ID.