DOP-C02 Practice Question 49: Inspector ECR Continuous Scanning
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 5 · question 9 of 10
A pipeline builds container images, pushes them to Amazon ECR, and deploys them to Amazon ECS. Security has two requirements. First, a deployment must be blocked if the image contains a critical vulnerability in either an operating system package or a programming language package. Second, the team must be alerted when a newly published CVE affects an image that is already in the registry, even if that image has not been rebuilt for months. The solution must add as little operational overhead as possible.
Which solution meets these requirements?
Show answer and explanation
Answer:
Enhanced scanning covers both halves. On coverage: "with enhanced scanning, you scan for operating system and programming language package vulnerabilities at the registry level", which is what the first requirement asks for. On the second requirement, continuous scanning re-scans an existing image "whenever Amazon Inspector adds a new common vulnerabilities and exposures (CVE) item to its database, and that CVE is relevant to that container image", so an image that has sat untouched for months still generates a finding when a new CVE lands. Inspector findings integrate with EventBridge and Security Hub, giving the alert path without polling, and the whole thing is a managed service rather than tooling the team runs.
Option A is the right shape with the wrong scan type. Basic scanning is limited compared with enhanced scanning, and the documentation notes you can manage enhanced findings "using AWS services not available for basic scanning, like AWS Security Hub CSPM and Amazon EventBridge". A scan-on-push result is also a point-in-time verdict, so a CVE published after the push is never noticed.
Option B only ever looks at images at build time. An image already in the registry is never re-examined, which fails the second requirement outright, and the team now owns a scanner, its vulnerability database, and its runtime in the build.
Option C checks the wrong layer. The CIS benchmark standard evaluates AWS account and resource configuration (root MFA, logging, public access), and does not inspect the packages inside a container image.
Reference: Scanning Amazon Elastic Container Registry container images with Amazon Inspector