DOP-C02 · Question #247
A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers…
The correct answer is C. Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in D. Create an AWS CodeBuild project that builds the Docker images and stores the Docker images in. To automate Docker image building for EKS with vulnerability scanning and notifications, use AWS CodeBuild to build and push images to Amazon ECR, then configure ECR image scanning to send high-priority findings via EventBridge to an SNS topic.
Question
A company has deployed a new platform that runs on Amazon Elastic Kubernetes Service (Amazon EKS). The new platform hosts web applications that users frequently update. The application developers build the Docker images for the applications and deploy the Docker images manually to the platform. The platform usage has increased to more than 500 users every day. Frequent updates, building the updated Docker images for the applications, and deploying the Docker images on the platform manually have all become difficult to manage. The company needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if Docker image scanning returns any HIGH or CRITICAL findings for operating system or programming language package vulnerabilities. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files.
- BCreate an AWS CodeCommit repository to store the Dockerfile and Kubernetes deployment files.
- CCreate an AWS CodeBuild project that builds the Docker images and stores the Docker images in
- DCreate an AWS CodeBuild project that builds the Docker images and stores the Docker images in
- ECreate an AWS CodeBuild project that scans the Dockerfile. Configure the project to build the
How the community answered
(40 responses)- A18% (7)
- B5% (2)
- C70% (28)
- E8% (3)
Why each option
To automate Docker image building for EKS with vulnerability scanning and notifications, use AWS CodeBuild to build and push images to Amazon ECR, then configure ECR image scanning to send high-priority findings via EventBridge to an SNS topic.
While an AWS CodeCommit repository is necessary for source control, it does not by itself automate the Docker image building, scanning, or notification process.
This option is truncated and appears identical to A, thus suffering from the same limitation of not providing a complete solution for automation, scanning, and notification.
AWS CodeBuild automates the process of building Docker images, which are then stored in Amazon ECR for use by EKS, addressing the need for automated image building and storage.
This option, assuming its full text describes configuring Amazon ECR to enable image scanning on push and setting up Amazon EventBridge rules to send ECR scan findings (specifically HIGH or CRITICAL) to an SNS topic, directly fulfills the requirement for vulnerability alerts.
While CodeBuild can perform some scanning, Amazon ECR's native image scanning provides comprehensive vulnerability analysis for the *built Docker image* itself, which is the explicit requirement, making it a more direct and efficient solution than scanning the Dockerfile via CodeBuild.
Concept tested: AWS CI/CD for EKS, CodeBuild, ECR image scanning, and vulnerability notifications
Source: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
Topics
Community Discussion
No community discussion yet for this question.