DOP-C02 Question 28
Select 2Your organization is implementing a CI/CD pipeline in AWS for a containerized application. The containers will be deployed on an Amazon ECS cluster using Fargate. As part of the pipeline, security policies mandate that all container images must be scanned for vulnerabilities before deployment. Which service or combination of services should you integrate into the pipeline to meet this requirement?
- A
Amazon Inspector
- B
AWS CodePipeline with a third-party scanning tool integrated as a custom action
- C
Amazon Elastic Container Registry (ECR) vulnerability scanning
- D
AWS Systems Manager Patch Manager
- E
AWS Trusted Advisor
Show answer and explanation
Correct answers: B, C
Explanation
To comply with the requirement to scan container images for vulnerabilities, you can leverage Amazon Elastic Container Registry (ECR), which provides built-in image vulnerability scanning. Additionally, AWS CodePipeline can be configured with a third-party scanning tool as a custom action, offering a flexible way to integrate security into the CI/CD pipeline. Together, these options ensure compliance with security policies while supporting an automated pipeline workflow.
- A. Incorrect.
Amazon Inspector is a powerful service for identifying vulnerabilities and compliance issues, but it does not natively scan container images stored in Amazon ECR.
- B. Correct.
AWS CodePipeline supports custom actions, allowing you to integrate third-party scanning tools to scan container images as part of your CI/CD pipeline.
- C. Correct.
Amazon Elastic Container Registry (ECR) has built-in vulnerability scanning for container images, making it a straightforward and efficient choice for scanning images before deployment.
- D. Incorrect.
AWS Systems Manager Patch Manager is designed for managing patches on EC2 instances and on-premises systems, not for scanning container images.
- E. Incorrect.
AWS Trusted Advisor provides cost optimization, security, and performance recommendations but does not scan container images for vulnerabilities.