CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A deployment pipeline pushes a new Docker image to production. The image was built FROM ubuntu:latest. What are the security risks of using 'latest' tag?
- A.latest tags are always the most secure because they have the newest patches
- B.Using latest causes the container to always restart automatically
- C.latest tags cannot be pulled by Docker registries
- D.'latest' is a floating tag - each build may pull a different version of the base image, making builds non-reproducible and introducing unexpected changes. A new ubuntu:latest could include vulnerable packages or API-breaking changes. Best practice: pin to specific versions (ubuntu:22.04) for reproducibility and explicit upgrade control
Why D is correct
The 'latest' tag is a common anti-pattern. It doesn't mean most secure or most stable - it means the most recently pushed image with that tag. Using it: (1) makes builds non-deterministic; (2) can silently pull vulnerable base images; (3) makes it impossible to know exactly what version is running. Pinning to specific versions (ubuntu:22.04 or even a specific digest sha256:...) ensures reproducibility and intentional upgrades.
Know someone studying for Web App Fundamentals? Send them this one.