Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 96 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 96
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company is using Amazon Elastic Container Service (Amazon ECS) to run its container-based application on AWS. The company needs to ensure that the container images contain no severe vulnerabilities. The company also must ensure that only specific IAM roles and specific AWS accounts can access the container images.

Which solution will meet these requirements with the LEAST management overhead?

A. Pull images from the public container registry. Publish the images to Amazon Elastic Container Registry (Amazon ECR) repositories with scan on push configured in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use identity-based policies to restrict access to which IAM principals can access the images.
B. Pull images from the public container registry. Publish the images to a private container registry that is hosted on Amazon EC2 instances in a centralized AWS account. Deploy host-based container scanning tools to EC2 instances that run Amazon ECS. Restrict access to the container images by using basic authentication over HTTPS.
C. Pull images from the public container registry. Publish the images to Amazon Elastic Container Registry (Amazon ECR) repositories with scan on push configured in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use repository policies and identity-based policies to restrict access to which IAM principals and accounts can access the images.
D. Pull images from the public container registry. Publish the images to AWS CodeArtifact repositories in a centralized AWS account. Use a CI/CD pipeline to deploy the images to different AWS accounts. Use repository policies and identity-based policies to restrict access to which IAM principals and accounts can access the images.

Show Suggested Answer

Suggested Answer: C 🗳️

by oioi at Nov. 23, 2023, 9:47 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

phmeeeee

2 months, 3 weeks ago

Selected Answer: C

1. ECR can scan on push. 2. ECR can have resource-based policy to allow the specific IAM/principal 3. LEAST management overhead.

upvoted 1 times

...

ion_gee

8 months, 1 week ago

Selected Answer: C

Answer is C. A just falls short due to absence of a required repository policy in addition to an IAM policy

upvoted 1 times

...

Gafa255

11 months, 1 week ago

Selected Answer: C

https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policies.html

upvoted 2 times

...

Daniel76

1 year ago

Selected Answer: C

https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policies.html

upvoted 1 times

...

AgboolaKun

1 year, 1 month ago

Selected Answer: C

C is the correct answer. Please refer to https://aws.amazon.com/premiumsupport/knowledge-center/secondary-account-access-ecr/

upvoted 2 times

...

Aamee

1 year, 1 month ago

Selected Answer: C

Should be C as it logically answers for not only the question of providing a solution of vulnerable free container image process but also covers the method of its access restrictions via IAM roles/principals and accounts as well.

upvoted 1 times

...