A company is building new learning management applications on AWS. The company is using Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 to host the applications. The company must ensure th

Question

Options

• AModify the ECS cluster properties to use privileged mode. Enable host-based logging.
• BUse the AWS Config conformance pack for Amazon ECS. Use AWS Config to notify
• CConfigure AWS WAF to invoke an Amazon CloudWatch alarm when a new security vulnerability
• DUse Amazon Inspector to scan container images in Amazon Elastic Container Registry (Amazon
• EUse AWS Systems Manager Parameter Store to encrypt container images.

• A
  17% (5)
• B
  69% (20)
• C
  10% (3)
• E
  3% (1)

Explanation

Use Amazon Inspector to scan container images in Amazon Elastic Container Registry (Amazon Amazon Inspector natively integrates with ECR to automatically scan container images for known vulnerabilities (CVEs) whenever images are pushed or periodically rescanned. This directly addresses the requirement to ensure that container images are secure. Use the AWS Config conformance pack for Amazon ECS. Use AWS Config to notify administrators if any security vulnerabilities are detected. The ECS conformance pack includes AWS Config managed rules that check for security-related misconfigurations (for example, tasks running as root, lack of logging, insecure settings). AWS Config can be set to send notifications (via EventBridge / SNS) when resources are noncompliant, thereby alerting administrators about security issues related to the container Together, Amazon Inspector handles image vulnerability scanning, while AWS Config with the ECS conformance pack and notifications ensures ongoing security posture monitoring and alerting with minimal operational effort.

No community discussion yet for this question.