1Z0-1104-25 Question 108
Select 2Your organization stores regularly updated container images in Oracle Cloud Infrastructure (OCI) Container Registry (OCIR) and also maintains several compute instances for production workloads. You are responsible for ensuring both container images and hosts are scanned on a weekly schedule to detect critical vulnerabilities. Which two actions should you take to achieve this using OCI's native vulnerability scanning capabilities?
- A
Enable Container Image Scanning in the OCI Vulnerability Scanning service, configure a scanning recipe for container images, and apply it to your repositories in OCIR.
- B
Use a host scanning recipe in the OCI Vulnerability Scanning service and schedule weekly scans on your compute instances to detect OS-level vulnerabilities.
- C
Enable a built-in vulnerability patching feature in Oracle Cloud Guard to automatically fix vulnerabilities in container images stored in OCIR.
- D
Use only identity policies to restrict access to container images, assuming scanning occurs automatically when images are pushed to OCIR.
- E
Rely solely on custom scripts and open-source scanning tools on local workstations before pushing images into OCIR.
Show answer and explanation
Correct answers: A, B
Explanation
To implement vulnerability scanning for both hosts and container images in OCI, you should use the OCI Vulnerability Scanning service. Configure scanning recipes for container images in OCIR and schedule regular host scans for compute instances. Refer to the Oracle documentation on the OCI Vulnerability Scanning service (docs.oracle.com/en-us/iaas/Content/VulnerabilityScanning/overview.htm) for detailed instructions on configuring and managing scanning recipes, setting up schedules, and integrating scanning results with other OCI security services.
- A. Correct.
Option 1 (Correct): Enabling Container Image Scanning in the OCI Vulnerability Scanning service allows you to scan container images for known vulnerabilities. By configuring a scanning recipe and applying it to your repositories in OCIR, you can automatically scan images upon upload or on a scheduled basis. This is a recommended practice to ensure images are continuously monitored for security issues.
- B. Correct.
Option 2 (Correct): The Vulnerability Scanning service also supports host OS-level scanning. You can create a weekly schedule using a host scanning recipe, enabling detection of vulnerabilities on your compute instances. This ensures that hosts are assessed periodically for security risks and that you receive alerts if patches or additional actions are necessary.
- C. Incorrect.
Option 3 (Incorrect): Oracle Cloud Guard can detect some configuration issues and potential security threats, but it does not offer an automatic vulnerability patching feature for container images stored in OCIR. Remediation actions typically require manual intervention or specialized tools.
- D. Incorrect.
Option 4 (Incorrect): While identity policies are crucial for controlling who can push and pull images, they do not automatically trigger scans. Identity policies alone do not protect against vulnerabilities within the images themselves.
- E. Incorrect.
Option 5 (Incorrect): Although using open-source scanning tools locally can be beneficial, relying solely on custom scripts does not leverage OCI� native scanning capabilities. OCI� service provides an integrated approach with automated scheduling and reporting, which is more consistent and scalable.