Your vulnerability scanner reports 200 CVEs in a production image. How do you handle it?
What they are really testing: Whether you can triage rather than panic or ignore. Both "block everything" and "ignore it all" are failures, and they want to hear reachability and exploitability reasoning.
A real interview question
Your vulnerability scanner reports 200 CVEs in a production image. How do you handle it?
What most people say
drag me
“Block the deploy until all 200 are fixed.”
It sounds rigorous and is unworkable. Many will have no available fix, some are unreachable in your usage, and a policy nobody can satisfy gets bypassed within a week, leaving you with no policy at all.
The follow-ups they ask next
How do you decide whether a CVE is actually reachable?
Some scanners do reachability analysis against the call graph. Otherwise reason about it: is the vulnerable function on a path your code invokes, and is the input attacker-controlled?
What would you do about the base image long term?
Standardise on a small set of maintained base images rebuilt on a schedule, so patching happens centrally, plus distroless where possible so there is far less installed to scan.
What the interviewer is listening for
- Triages by severity and reachability
- Finds the base image as the bulk cause
- Designs a policy people can actually follow
What sinks the answer
- Blocks on all findings
- Ignores the report entirely
- No plan to prevent regrowth
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I triage by [severity crossed with reachability and exploitability]. Usually [a stale base image accounts for most of the count], so rebuilding removes many at once. Then [fail the build on NEW criticals so it cannot grow], while [existing ones get owners and deadlines]. Blocking all 200 [just gets bypassed].”
Keep going with security
Junior
Your pipeline needs credentials to deploy to production. How do you handle that safely?
Mid
How would you rotate a database password used by 12 running services with no downtime?
Mid
Your deploy role has full administrator access because narrowing it kept breaking things. How do you fix that properly?
Senior
Compliance requires that every production change is approved and auditable. How do you keep deploying daily?
Senior
How would you protect your build pipeline from a supply chain attack?
Mid
Our pipeline takes 45 minutes and developers have stopped waiting for it. How do you fix that?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free