Q100 — AWS SAA-C03 Ch.16

Question 100 of 100 | ← Chapter 16

Q1300. A company is building new learning management applications on AWS. The company is using Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 to host the applications. The company must ensure that container images are secure. Company administrators must receive notifications of any security vulnerabilities in the images. Which combination of solutions will meet these requirements?(Select TWO.)

Correct Answer: B. Use the AWS Config conformance pack for Amazon ECS. Use AWS Config to notify administrators if any security vulnerabilities are detected., D. Use Amazon Inspector to scan container images in Amazon Elastic Container Registry(Amazon ECR).

Explanation

The correct answers are D. Use Amazon Inspector to scan container images in Amazon Elastic Container Registry (Amazon ECR) and B. Use the AWS Config conformance pack for Amazon ECS. Use AWS Config to notify administrators if any security vulnerabilities are detected (though D is the stronger choice for vulnerability detection, while B is more about compliance monitoring).However, D is the most direct and effective solution for detecting security vulnerabilities in container images, while B can supplement it by enforcing security best practices and notifying administrators of compliance issues.Explanation:D. Use Amazon Inspector to scan container images in Amazon ECR Amazon Inspector is a vulnerability management service that automatically scans container images stored in Amazon Elastic Container Registry (ECR) for known vulnerabilities and deviations from best practices. It integrates with Amazon ECR and provides detailed reports on vulnerabilities, which can trigger Amazon CloudWatch alarms or AWS SNS notifications to administrators. This is the most direct and effective solution for detecting security vulnerabilities in container images. B. Use the AWS Config conformance pack for Amazon ECS. Use AWS Config to notify administrators if any security vulnerabilities are detectedAWS Config can monitor and enforce compliance for Amazon ECS resources (e.g., ensuring containers run in non-privileged mode, using secure configurations).The AWS Config conformance pack for ECS includes rules for security best practices. While AWS Config does not directly scan for vulnerabilities in container images (unlike Amazon Inspector), it can detect misconfigurations that may introduce security risks. AWS Config can send notifications via Amazon SNS when non-compliant resources are detected.Why the other options are incorrect:A. Modify the ECS cluster properties to use privileged mode. Enable host-based logging. Privileged mode should be avoided unless absolutely necessary, as it grants containers elevated permissions (a security risk).Host-based logging does not detect vulnerabilities in container images. C. Configure AWS WAF to invoke an Amazon CloudWatch alarm when a new security vulnerability is detected.AWS WAF protects web applications from common exploits (e.g., SQL injection, XSS) but does not scan container images for vulnerabilities.E. Use AWS Systems Manager Parameter Store to encrypt container images. AWS Systems Manager Parameter Store stores secrets and configuration data securely but does not encrypt or scan container images.Container images in Amazon ECR are already encrypted at rest by default.Best Combination:D (Amazon Inspector) is the primary solution for detecting vulnerabilities in container images. B (AWS Config) can supplement by enforcing security best practices and notifying administrators of misconfigurations.However, if only two options must be selected, D is mandatory, and B is a secondary but useful choice.Final Answer: D and B (though D is the most critical for vulnerability detection).