While auditing a cloud image configured for deployment, which of the following findings represents a deployment misconfiguration?

Option A: While missing a health check directive is not ideal for production readiness, it is not a security

misconfiguration. Health checks are primarily for operational monitoring and ensuring high availability.

Option B: This is a best practice to ensure only authorized users can access the image. It strengthens the

11/192

security of the deployment pipeline and does not represent a misconfiguration.

Option C: Adding labels for versioning and maintainability metadata (e.g., LABEL version="1.0") is a

best practice. It aids in managing image lifecycles and troubleshooting deployments. This does not

constitute a misconfiguration.

Option D: Including unused software packages increases the attack surface and may introduce

unnecessary vulnerabilities. Attackers could exploit unmaintained or outdated components, even if they

are not actively used by the application. Removing unnecessary packages during the build process is a

key security best practice.