nerdexam
Amazon

DOP-C02 · Question #447

A DevOps engineer needs a resilient CI/CD pipeline that builds container images, stores them in ECR, scans images for vulnerabilities, and is resilient to outages in upstream source image repositories

The correct answer is D. Create a private ECR repo, enable basic scanning, create a pull-through cache rule.. ECR pull-through cache caches images from upstream repositories for resilience. Private repo with basic scanning ensures vulnerability detection on pushed images. Enabling pull-through caching on a private repo combines caching and vulnerability scanning Public repos do not suppo

Submitted by kavita_s· Mar 6, 2026Resilient Cloud Solutions

Question

A DevOps engineer needs a resilient CI/CD pipeline that builds container images, stores them in ECR, scans images for vulnerabilities, and is resilient to outages in upstream source image repositories. Which solution meets this?

Options

  • ACreate a private ECR repo, scan images on push, replicate images from upstream repos with a
  • BCreate a public ECR repo to cache images from upstream repos, create a private repo to store
  • CCreate a public ECR repo, configure a pull-through cache rule, create a private repo to store
  • DCreate a private ECR repo, enable basic scanning, create a pull-through cache rule.

How the community answered

(55 responses)
  • A
    4% (2)
  • B
    13% (7)
  • C
    4% (2)
  • D
    80% (44)

Explanation

ECR pull-through cache caches images from upstream repositories for resilience. Private repo with basic scanning ensures vulnerability detection on pushed images. Enabling pull-through caching on a private repo combines caching and vulnerability scanning Public repos do not support pull-through caching of upstream images. Replication rules are for multi-Region replication, not upstream caching.

Topics

#ECR#Pull-through cache#Container security#Supply chain resilience

Community Discussion

No community discussion yet for this question.

Full DOP-C02 Practice