Which practice helps secure the container image supply chain?

• A. Using network segmentation alone.
• B. Using root containers for compatibility.
• C. Image signing and scanning.
• D. Disabling dependency checks.

Answer: (C)

Verifying where an image came from and what it contains is essential to a trusted container supply chain. Image signing provides provenance and tamper-evidence: the image is signed with a private key and can be verified with a trusted public key, so only images from approved sources are accepted and any unauthorized changes are detected. Image scanning adds the security check for content, examining the image layers for known vulnerabilities, outdated components, misconfigurations, or malicious code, and surfacing risk results that teams can act on. Together, signing and scanning create a stronger barrier: you know the image’s origin and integrity, and you’ve identified and can remediate potential risks before deployment. In practice, this pairing is often automated in CI/CD pipelines, gating promotions on successful signature verification and a clean scan. Other approaches don’t address both provenance and content risk on arrival—network segmentation protects networks but not image provenance, root containers introduce security hazards, and disabling dependency checks removes critical safeguards against vulnerable components.