312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

By ECCouncil · Question Mode

QuestionQ83

DevSecOps Pipeline-Code Stage

Amy Ryan works as a DevSecOps engineer at an IT company that builds software products and web applications focused on cyber security. She uses the Anchore tool for container vulnerability scanning and Software Bill of Materials (SBOM) generation, which allows her to quickly scan and generate a list of known vulnerabilities from an SBOM, a container image, or a project directory.

Which command should Amy run so that the generated SBOM includes software from all of the image's layers?

  • A syft packages < image > --scope all-layers
  • B syft packages < image > scope all_layers SBOM
  • C syft packages < image > --scope all-layers Anchore
  • D syft packages < image > scope all_layers
Explanation

Syft, the SBOM generation tool used within the Anchore ecosystem, supports a --scope command-line option that determines how much of a container image is analyzed. Setting --scope all-layers instructs Syft to inspect every layer of the image (not just the final squashed filesystem), capturing packages that may have been added and later removed in intermediate layers. The correct syntax for this is 'syft packages <image> --scope all-layers', using the double-dash flag naming convention and hyphenated value that Syft's CLI actually recognizes.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!