1Z0-1104-25 Question 106
Select 2Your company is running several containerized applications on Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes and multiple Compute instances. You need to ensure that vulnerabilities in both the underlying hosts and the container images are identified quickly so they can be remediated before they impact production. Which two approaches will help you achieve this objective using OCI's native capabilities?
- A
Configure OCI Vulnerability Scanning Service to scan all Compute instances on a scheduled basis and enable the container image scanning feature in OCI Container Registry.
- B
Rely solely on the OS Management Service to automatically patch the hosts without scheduling any vulnerability scans.
- C
Enable container image scanning in OCI Container Registry for each new image push and schedule OCI Vulnerability Scanning Service scans for hosts in each compartment.
- D
Use an external third-party scanner that requires manual uploads of images periodically and does not integrate with OCI Container Registry.
Show answer and explanation
Correct answers: A, C
Explanation
OCI provides a native Vulnerability Scanning Service that can be configured to scan Compute instances and container images stored in OCI Container Registry. By scheduling regular scans for hosts and enabling automatic image scanning during the push process, you greatly improve your security posture. Refer to the Oracle Cloud Infrastructure Security documentation for step-by-step guidance on configuring and scheduling vulnerability scans for both hosts and container images.
- A. Correct.
Option 1 is correct. OCI Vulnerability Scanning Service can scan hosts for vulnerabilities and open ports on a schedule. Additionally, enabling container image scanning in OCI Container Registry allows automatic scans of container images to identify known vulnerabilities. This combination addresses both host OS and container image security.
- B. Incorrect.
Option 2 is incorrect. While OS Management Service can simplify patching, it does not replace vulnerability scanning. Without scheduled scans, you could miss exposures in real time.
- C. Correct.
Option 3 is correct. By enabling image scanning in OCI Container Registry when images are pushed and scheduling Vulnerability Scanning Service scans for hosts, you ensure continuous monitoring of new and existing vulnerabilities in both container images and hosts.
- D. Incorrect.
Option 4 is incorrect. Integrations with third-party tools can enhance security, but relying solely on manual uploads and external scanning outside OCI Container Registry is not efficient. A scan that is not integrated with OCI Registry or hosts often results in missed vulnerabilities or outdated information.