nerdexam
Amazon

DOP-C02 · Question #203

A company runs an application for multiple environments in a single AWS account. An AWS CodePipeline pipeline uses a development Amazon Elastic Container Service (Amazon ECS) cluster to test an…

The correct answer is D. Use Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. Set a repository policy. https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Submitted by thandi_sa· Mar 6, 2026Security and Compliance

Question

A company runs an application for multiple environments in a single AWS account. An AWS CodePipeline pipeline uses a development Amazon Elastic Container Service (Amazon ECS) cluster to test an image for the application from an Amazon Elastic Container Registry (Amazon ECR) repository. The pipeline promotes the image to a production ECS cluster. The company needs to move the production cluster into a separate AWS account in the same AWS Region. The production cluster must be able to download the images over a private connection. Which solution will meet these requirements?

Options

  • AUse Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. In the separate AWS
  • BSet a repository policy on the production ECR repository in the main AWS account. Configure the
  • CConfigure ECR private image replication in the main AWS account. Activate cross-account
  • DUse Amazon ECR VPC endpoints and an Amazon S3 gateway endpoint. Set a repository policy

How the community answered

(35 responses)
  • A
    9% (3)
  • B
    14% (5)
  • C
    23% (8)
  • D
    54% (19)

Explanation

https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Topics

#ECR cross-account access#VPC endpoints#repository policy#private networking#container images

Community Discussion

No community discussion yet for this question.

Full DOP-C02 Practice