Which feature of a secure CI/CD pipeline defends container workloads against detected exploits, application flaws,...

Runtime protection monitors and protects a container after deployment while its processes are executing. This is the stage at which attempted exploitation, unexpected process behavior, vulnerable packages, configuration weaknesses, and policy violations can become active threats. Cisco describes cloud workload protection as defending containers and other workloads against runtime threats, misconfigurations, and vulnerabilities. Consequently, option C directly matches the requirement. Control groups are a Linux resource-management mechanism; they limit or account for CPU, memory, and other resources but are not a complete security capability. Separation of duties is an administrative control that reduces excessive privilege in development and operations. Cloud-native firewalling controls network flows, but it does not by itself observe or stop every malicious action inside a running container. Cisco’s cloud workload protection overview confirms the runtime distinction.

================