AWS Certified DevOps Engineer - Professional DOP-C02Demo

By Amazon · Question Mode

QuestionQ4

Monitoring and Logging

A company uses a continuous integration pipeline in which it builds container images with AWS CodeBuild. The generated images are stored in Amazon Elastic Container Registry (Amazon ECR).

Reviewing and remediating image vulnerabilities is taking the company too long. The company needs to rapidly identify image vulnerabilities and notify the security team about them.

Which combination of steps meets these requirements with the LEAST operational overhead?

Choose two
  • A Activate Amazon Inspector enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
  • B Create an Amazon EventBridge rule for Amazon Inspector findings. Set an Amazon Simple Notification Service (Amazon SNS) topic as the rule target.
  • C Activate AWS Lambda enhanced scanning for Amazon ECR. Configure the enhanced scanning to use continuous scanning. Set up a topic in Amazon Simple Email Service (Amazon SES).
  • D Create a new AWS Lambda function. Invoke the new Lambda function when scan findings are detected.
  • E Activate default basic scanning for Amazon ECR for all container images. Configure the default basic scanning to use continuous scanning. Set up a topic in Amazon Simple Notification Service (Amazon SNS).
Explanation

Amazon ECR enhanced scanning integrates with Amazon Inspector to provide automated continuous scanning of container images. Amazon Inspector emits EventBridge events when image scan findings are created, updated, or closed. An EventBridge rule targeting an Amazon SNS topic can therefore notify the security team without maintaining custom Lambda code. Basic scanning supports only manual or scan-on-push frequencies, not continuous scanning.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!