AWS Certified DevOps Engineer - Professional DOP-C02 Exam - Question 238

Question

A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization.

The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images.

A DevOps engineer needs to create a strategy to centralize this process.

Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)

Examice · Accepted Answer

To meet the requirements with the least administrative overhead, it is appropriate to create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account. This ensures centralized management. Create separate repositories for pre-scan and post-scan images. Implementing Amazon ECR image scanning to run on new image pushes to the pre-scan repositories ensures all images are scanned per the regulation. Use resource-based policies to control access appropriately. Additionally, creating an AWS Lambda function that is triggered by Amazon EventBridge rules to react to image scanning completed events and push images without critical vulnerabilities to the post-scan repositories minimizes administrative overhead by automating the process after scanning, and avoids the complexity of managing multiple pipelines.

trungtd · Answer

LEAST administrative overhead:
=> Should create ECR repositories in the shared services account => A
And should create only 1 Lambda function => E

D wrong because it involves creating and managing multiple pipelines, which increases administrative overhead significantly

xdkonorek2 · Answer

E > D for LEAST administrative overhead

jamesf · Answer

keywords: LEAST Administrative overhead

Option A centralizes the repository management in the shared services account, simplifying access control and configuration management. Pre-scan and post-scan repositories are clearly separated, ensuring that only post-scan images are deployed.

Option E uses event-driven automation to handle the scanning results and image promotion, reducing manual intervention and ensuring that only images that pass the security scan are moved to the post-scan repositories. This approach is efficient and minimizes administrative overhead compared to manually setting up pipelines or replication mechanisms.

aws_god · Answer

Lambda is not meant to work with Docker

auxwww · Answer

Why not E - To push images to the post-scan repo, you need a custom lambda container to run docker pull and push commands which is more complicated than Option D

limelight04 · Answer

AD gives the least administrative overhead

Anonymous · Answer

---> AE

auxwww · Answer

Why E is not optimal - https://stackoverflow.com/questions/51158595/build-and-push-docker-image-to-aws-ecr-using-lambda

jojewi8143 · Answer

AE because lambda

AWS Certified DevOps Engineer - Professional DOP-C02 Exam - Question 238

Discussion