SAA-C03 Q497 · Security

Question

A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned. Which solution will meet these requirements with the FEWEST changes to the workloads?

Accepted Answer

**Option A: Use Amazon ECR as a private image repository with scan on push filters for ECR basic scan.**

Let's map each requirement:

1. **Scan container images for CVEs**: Amazon ECR natively supports image scanning. The **basic scan** feature uses the open-source Clair project database to detect CVEs in container images. This directly addresses the CVE scanning requirement.

2. **New container images also need to be scanned**: The **scan on push** feature automatically triggers a vulnerability scan every time a new image is pushed to the repository. No manual intervention needed.

3. **FEWEST changes to the workloads**: This is the critical constraint. The company already runs on ECS. ECS task definitions reference container images from a registry. Moving images to ECR (if not already t

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips