SCS-C02 Question 248
Single answerAn organization is using Amazon Elastic Container Service (ECS) to manage its containerized workloads. They want to ensure that container images stored in Amazon Elastic Container Registry (Amazon ECR) are free from known vulnerabilities before deployment. Which service or feature should they use to achieve this?
- A
Amazon Inspector
- B
Amazon GuardDuty
- C
Amazon ECR image scanning
- D
AWS Trusted Advisor
Show answer and explanation
Correct answer: C
Explanation
To ensure that container images stored in Amazon ECR are free of vulnerabilities before deployment, the organization should use Amazon ECR image scanning. This feature integrates with vulnerability databases to identify known vulnerabilities in container images, providing a proactive approach to securing workloads. Other services like Amazon Inspector and GuardDuty are useful for broader security tasks but are not specific to pre-deployment image scanning in Amazon ECR.
- A. Incorrect.
Amazon Inspector is primarily used for automated security assessments of EC2 instances and container workloads running on Amazon ECS. While it can scan for vulnerabilities, it does not directly scan ECR images for vulnerabilities before deployment.
- B. Incorrect.
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It does not perform vulnerability scanning for container images.
- C. Correct.
Amazon ECR image scanning is a feature specifically designed to scan container images stored in Amazon ECR for known vulnerabilities. This is the correct service for ensuring image security before deployment.
- D. Incorrect.
AWS Trusted Advisor provides recommendations to optimize AWS environments concerning cost, performance, and security but does not perform vulnerability scans on container images.