Report coverage, not just findings

short · 45 min · Objective 4.1

Task

Scan a set of images you built and then answer the question that matters more than the finding count: what proportion of your estate was actually assessed? A report of 400 findings across 300 assets is meaningless if there are 900.

Steps

  1. Build three images from different bases: a full distribution base, a slim variant, and a minimal or distroless one, all running the same trivial application.
  2. Scan each and record the finding counts by severity in lab/scan.csv, alongside the image size.
  3. Write the coverage statement in lab/coverage.md: enumerate every image present on the machine, state how many were scanned, and express coverage as a percentage.
  4. Deliberately add an unscanned image to the machine and re-run your coverage calculation. Confirm the percentage drops and that the unscanned image is named.
  5. Write the comparison: how much of the difference in findings between the three images is explained by base image choice alone?

Verify

awk -F, 'NR>1 && NF>=3 {n++} END {print n" image(s) scanned"}' lab/scan.csv
grep -Eci 'coverage' lab/coverage.md
grep -Ec '[0-9]+ ?%' lab/coverage.md
grep -Eci 'unscanned|not scanned' lab/coverage.md

Three images with different finding counts, and a coverage percentage that names what was missed. A scan report without a coverage figure cannot be acted on, because you do not know what it did not look at.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.