Answer-first summary for fast verification
Answer: Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Analyze the scan report after the next push of images.
The correct answer is option B. To meet the requirements of encrypting the ECR private repositories with AWS KMS and analyzing the container images for CVEs, you need to recreate the ECR repositories with both KMS encryption and ECR scanning enabled. Once the repositories are recreated, the scan report can be analyzed after the next push of images to ensure they are free of vulnerabilities. The other options either do not fully address the requirements or use services that are not relevant to the task.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A company is operating internal microservices on Amazon Elastic Container Service (Amazon ECS) using the Amazon EC2 launch type. They are utilizing Amazon Elastic Container Registry (Amazon ECR) private repositories. A security engineer has been tasked with ensuring that these private repositories are encrypted using AWS Key Management Service (AWS KMS) and that the container images are scanned for common vulnerabilities and exposures (CVEs). Which of the following solutions will effectively meet these security requirements?
A
Enable KMS encryption on the existing ECR repositories. Install Amazon Inspector Agent from the ECS container instances’ user data. Run an assessment with the CVE rules.
B
Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Analyze the scan report after the next push of images.
C
Recreate the ECR repositories with KMS encryption and ECR scanning enabled. Install AWS Systems Manager Agent on the ECS container instances. Run an inventory report.
D
Enable KMS encryption on the existing ECR repositories. Use AWS Trusted Advisor to check the ECS container instances and to verify the findings against a list of current CVEs.