1Z0-1104-25 Question 103
Single answerYou manage several Linux compute instances and container images hosted in OCI Container Registry. Your security team wants a solution that identifies newly released Common Vulnerabilities and Exposures (CVEs) and automatically scans both your hosts and container images on a regular schedule, providing clear severity ratings. Which approach will best meet these requirements?
- A
Enable only Oracle Cloud Guard, which automatically detects vulnerabilities in both container images and compute instances without any additional configuration.
- B
Use the Oracle Cloud Infrastructure (OCI) Vulnerability Scanning service for scheduled scanning of both compute instances and container images in OCI Container Registry.
- C
Rely on Oracle Linux OS updates exclusively, since it includes a built-in mechanism to notify you of new CVEs and critical patches.
- D
Configure a custom script to run daily on each compute instance, downloading CVE data from the National Vulnerability Database and comparing it against installed packages.
Show answer and explanation
Correct answer: B
Explanation
The OCI Vulnerability Scanning service is the recommended choice for proactively detecting vulnerabilities in both host operating systems and container images. By configuring regular scans and linking them to new CVE alerts, you ensure that vulnerabilities are quickly discovered and addressed. For more information, refer to Oracle� Vulnerability Scanning service documentation in the Oracle Cloud Infrastructure documentation.
- A. Incorrect.
Incorrect. Oracle Cloud Guard focuses on security posture management and detection of suspicious activities. It does not automatically perform comprehensive vulnerability scans on container images or compute instances without additional services.
- B. Correct.
Correct. OCI Vulnerability Scanning service supports both host scanning and container image scanning. It can be configured to run scheduled scans and to identify newly discovered vulnerabilities, making it an appropriate solution to meet the requirement.
- C. Incorrect.
Incorrect. While Oracle Linux updates can help with package-level updates, they do not provide a full solution for scanning container images or proactively identifying new vulnerabilities as they appear for all system components.
- D. Incorrect.
Incorrect. While custom scripts might help manage some vulnerabilities, this approach is labor-intensive, error-prone, and does not provide a single dashboard to track container image vulnerabilities. It also lacks direct integration with OCI services for automated scanning.