An auditor asks you to prove that the container running in production is the one that passed security scanning three weeks ago. What must be true?
Show the full answer Hide the answer
What the interviewer is testing
Whether you can connect a compliance question to the specific technical properties that answer it — and whether you know that most estates cannot answer this.
What must be true
Immutable, digest-addressed artifacts. The scan result must reference the image digest, not a
tag, because tags move. If your scan record says "scanned app:1.4.2" and your deployment says
"deployed app:1.4.2", you have proved nothing — those could be different images.
Build-once promotion. The scanned artifact must be the deployed artifact, not a rebuild from the same commit. A rebuild produces a different digest and is, formally, unscanned.
Deployment by digest. The running workload must be traceable to a digest, which means the deployment manifest references the digest and the runtime can report what it is actually running.
Retained scan records for at least the audit period, linked to the digest, with the scanner version and vulnerability database timestamp — because "no critical findings three weeks ago" means findings known at that time.
An attestation chain if you want the strong version: a signed statement from the build system recording source repository, commit, build definition and inputs, verified at admission so an unattested image cannot run.
The evidence to produce
| Question | Evidence |
|---|---|
| What is running? | Runtime inventory reporting image digests |
| Where did it come from? | Build provenance attestation naming repo, commit, builder |
| Was it scanned? | Scan record keyed by digest, with timestamp and scanner version |
| Could an unscanned image run? | Admission policy requiring signature and attestation, plus its own audit log |
That last row is the one auditors care about most and teams prepare for least: it is not enough to show that this image was scanned; you must show that an unscanned one could not have been deployed.
What a strong answer adds
Acknowledging the gap between "was scanned" and "is currently free of known vulnerabilities". A scan three weeks old says nothing about a vulnerability disclosed since. Continuous rescanning of deployed digests against the current vulnerability database, plus an SBOM per digest so the estate can be queried, is what actually answers the security question rather than the audit question.
Common weak answers
Pointing at the CI log as evidence. Assuming that because the pipeline includes a scan step, the running image was scanned.