DOP-C02 · Question #253
A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and…
The correct answer is A. Create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services D. Create a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that. To centralize container image scanning and ensure only secure images are deployed, ECR repositories should be in a shared services account, and a CodePipeline should automate scanning and promotion to a separate post-scan repository.
Question
A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization. The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images. A DevOps engineer needs to create a strategy to centralize this process. Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)
Options
- ACreate Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services
- BCreate pre-scan Amazon Elastic Container Registry (Amazon ECR) repositories in each account
- CConfigure image replication for each image from the image's pre-scan repository to the image's
- DCreate a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that
- ECreate an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image
How the community answered
(14 responses)- A50% (7)
- B29% (4)
- C14% (2)
- E7% (1)
Why each option
To centralize container image scanning and ensure only secure images are deployed, ECR repositories should be in a shared services account, and a CodePipeline should automate scanning and promotion to a separate post-scan repository.
Creating Amazon ECR repositories in the shared services account for both pre-scan and post-scan images centralizes image storage and management, which is essential for a unified security scanning process across multiple accounts.
Creating pre-scan ECR repositories in each individual application account defeats the purpose of a centralized scanning strategy and complicates management.
The choice is incomplete, and ECR image replication is primarily for multi-region availability or disaster recovery, not for the logical separation and promotion of pre-scan to post-scan images based on security scan results.
Creating an AWS CodePipeline for each pre-scan repository, with stages for monitoring, scanning, and conditional pushing to a post-scan repository, automates the security scanning workflow and strictly isolates compliant images from unscanned ones.
While an AWS Lambda function triggered by EventBridge could perform image scanning and promotion, AWS CodePipeline (Option D) is a more robust and standard solution designed for orchestrating multi-stage CI/CD workflows for centralized image management.
Concept tested: Centralized container image management, ECR, CodePipeline, security scanning
Source: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
Topics
Community Discussion
No community discussion yet for this question.