A regulated broking platform deploys only in the 01:00 to 05:00 window, through a pipeline with a Trivy image-scan gate that blocks any CRITICAL finding. Tonight's release of the order-routing service contains a mandatory change to exchange order-validation rules that takes effect at 09:15. The same image passed the gate at 18:00; at 02:05 it fails on a critical (CVSS 9.8) CVE in the base image's OpenSSL package, published at 19:00. The previous version running in production is built on the same base image.
The interviewer asks“It's two in the morning, you're running the release, and the pipeline's security gate fails on a brand-new critical CVE in the base image. The release carries a change the exchange requires to be live at market open. Walk me through exactly what you do, who decides, and what you change afterwards.”
First I separate two questions: is tonight's release safe to ship, and is production already exposed, because the running version has the same base image. I triage the finding fast: is the package really in the final image, is the vulnerable code loaded and reachable, is there a patched package, is it actively exploited. If a patched package exists I rebuild pinned to it and run the regression suite; if not, I bring a written analysis to the risk owner and the security on-call, who decide between a time-boxed, scoped exception with compensating controls or delaying the mandatory change. I never silently bypass the gate, and afterwards I fix the process: continuous scanning of built and running images, a pre-flight rescan before the window, a regular base-image cadence and VEX for findings we have proven not to affect us.
A free account unlocks the rest of it, and saves your progress across every track.
ssh-keygen Create and manage SSH keysssh-copy-id Install your public key on a serveropenssl Inspect certificates, test TLS and create keys and CSRsfail2ban-client Inspect and control fail2ban's brute-force bansufw Manage the host firewall the simple wayauditctl Add kernel audit rules: who touched what, and whensestatus Check SELinux status and modelast Show login history, reboots and failed logins