1Z0-1104-25 Question 107
Select 2You are a security administrator at an organization running microservices on Oracle Cloud Infrastructure (OCI). Your container images are stored in the OCI Container Registry, and the microservices run on Oracle Linux-based compute instances. You have been tasked with setting up vulnerability scanning for both container images and the underlying hosts. Which two steps must you take to ensure both your container images and your hosts are scanned for vulnerabilities?
- A
- Create a host scan target in the Vulnerability Scanning service, specifying the compartments where your compute instances reside.
- B
- Enable container image scanning in OCI Container Registry or create a container scan target referencing the repository compartments within the Vulnerability Scanning service.
- C
- Install the Oracle Cloud Agent on each compute instance and manually enable the Vulnerability Scanning plugin.
- D
- Configure an IAM policy explicitly granting the Vulnerability Scanning service read access to the underlying operating system files on your compute instances.
- E
- Tag each container image with 'vulnerability-scan' in OCI Container Registry to trigger automatic daily scans.
Show answer and explanation
Correct answers: A, B
Explanation
To implement vulnerability scanning for both hosts and container images in OCI, you must set up appropriate scan targets. For hosts, configure a host scan target specifying the compartments containing your compute instances. For container images, enable image scanning in OCI Container Registry (which provides automated scanning upon upload and on a schedule) or create a container scan target in the Vulnerability Scanning service. Refer to the Oracle Cloud Infrastructure documentation on Vulnerability Scanning service (VSS) for detailed configuration steps and best practices.
- A. Correct.
Option 1: Correct. Creating a host scan target is necessary so that the Vulnerability Scanning service knows which compute resources to scan for vulnerabilities. You specify the compartments containing your compute instances, allowing the service to discover and scan them automatically.
- B. Correct.
Option 2: Correct. For container images, you can enable scanning in OCI Container Registry, which scans new images upon push and on a schedule. Alternatively, you can create a container scan target in the Vulnerability Scanning service that references the compartments or repositories containing your images.
- C. Incorrect.
Option 3: Incorrect. While the Oracle Cloud Agent can be used for various monitoring and management tasks, host vulnerability scanning in OCI can be configured agentlessly for Oracle Linux-based compute instances. Deploying the agent and manually enabling a scanning plugin is not required in most standard setups.
- D. Incorrect.
Option 4: Incorrect. Although an IAM policy is often needed so that OCI services can interact with your resources, you do not need to explicitly grant read access to the OS file system for the Vulnerability Scanning service. The service handles scanning through its native mechanisms without direct file-level OS access.
- E. Incorrect.
Option 5: Incorrect. Tagging images with 'vulnerability-scan' is not a recognized method to trigger OCI Container Registry scanning. The official approach is to enable the built-in scanning feature in OCI Container Registry or create a container image scan target in the Vulnerability Scanning service.