SAA-C03 · Question #89
A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs)
The correct answer is A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the. The company needs to scan container images used by ECS workloads for CVEs, including newly created images, with minimal changes to existing workloads.
Question
A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned. Which solution will meet these requirements with the FEWEST changes to the workloads?
Options
- AUse Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the
- BStore the container images in an Amazon S3 bucket. Use Amazon Macie to scan the images.
- CDeploy the workloads to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic
- DStore the container images in an Amazon S3 bucket that has versioning enabled. Configure an
How the community answered
(15 responses)- A87% (13)
- B7% (1)
- D7% (1)
Why each option
The company needs to scan container images used by ECS workloads for CVEs, including newly created images, with minimal changes to existing workloads.
Amazon Elastic Container Registry (ECR) provides built-in image scanning for CVEs, which can be configured for both on-push scanning of new images and on-demand scanning of existing images. Using ECR as the private image repository for ECS workloads is a native integration that requires minimal changes to existing ECS task definitions.
Amazon S3 is object storage and does not provide native container image scanning capabilities; Amazon Macie is a data security service primarily for sensitive data discovery, not CVE scanning of container images.
Concept tested: Container image vulnerability scanning, ECR features
Source: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
Community Discussion
No community discussion yet for this question.