Q39 — AWS SAA-C03 Ch.12

Question 39 of 100 | ← Chapter 12

Q839. A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned.Which solution will meet these requirements with the FEWEST changes to the workloads?

• A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan. ✓
• B. Store the container images in an Amazon S3 bucket. Use Amazon Macie to scan the images. Use an S3 Event Notification to initiate a Macie scan for every event with an s3:ObjectCreated:Put event type.
• C. Deploy the workloads to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository. Specify scan on push filters for the ECR enhanced scan.
• D. Store the container images in an Amazon S3 bucket that has versioning enabled. Configure an S3 Event Notification for s3:ObjectCreated:* events to invoke an AWS Lambda function. Configure the Lambda function to initiate an Amazon Inspector scan.

Correct Answer: A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan.

Explanation

To meet the requirement of scanning container images for Common Vulnerabilities and Exposures (CVEs) used in Amazon Elastic Container Service (Amazon ECS) with the fewest changes to the workloads, the recommended solution is:A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan.Here's why:Option A suggests using Amazon ECR as a private image repository to store the container images. Amazon ECR provides a secure and managed container image registry service. It integrates well with Amazon ECS and offers built-in image scanning capabilities.By enabling the ECR basic scan, which is a no-cost feature, you can trigger a scan for known vulnerabilities when pushing container images to Amazon ECR. The scan on push filters allows you to define rules to determine which images trigger the vulnerability scan. This solution requires minimal changes to the existing workflow since it leverages the existing Amazon ECS and ECR ecosystem.Option B suggests storing the container images in an Amazon S3 bucket and using Amazon Macie to scan the images. While Macie is a service designed for data discovery and classification, it is not specifically designed for scanning container images for vulnerabilities. This option introduces additional complexity and may not provide the most efficient and effective scanning solution for container images in Amazon ECS.Option C suggests deploying the workloads to Amazon Elastic Kubernetes Service (Amazon EKS) and using Amazon ECR as a private image repository with the enhanced scan. While this option provides scanning capabilities, it requires migrating the workloads to Amazon EKS, which may involve significant changes to the existing infrastructure and workload deployment.Option D suggests storing the container images in an Amazon S3 bucket with versioning enabled. It proposes configuring an S3 Event Notification to invoke an AWS Lambda function that initiates an Amazon Inspector scan. While this option allows for scanning the images, it involves more complex setup and configuration using multiple services and may require modifying the workflow significantly.Therefore, the recommended solution to meet the requirements with the fewest changes to the workloads is to use Amazon Elastic Container Registry (Amazon ECR) as a private image repository and specify scan on push filters for the ECR basic scan. This solution seamlessly integrates with Amazon ECS and provides the necessary image scanning capabilities for CVEs while minimizing workflow changes.