Examice

Exam DOP-C02 All QuestionsBrowse all questions from this exam

Question 238

A company is migrating its container-based workloads to an AWS Organizations multi-account environment. The environment consists of application workload accounts that the company uses to deploy and run the containerized workloads. The company has also provisioned a shared services account for shared workloads in the organization.

The company must follow strict compliance regulations. All container images must receive security scanning before they are deployed to any environment. Images can be consumed by downstream deployment mechanisms after the images pass a scan with no critical vulnerabilities. Pre-scan and post-scan images must be isolated from one another so that a deployment can never use pre-scan images.

A DevOps engineer needs to create a strategy to centralize this process.

Which combination of steps will meet these requirements with the LEAST administrative overhead? (Choose two.)

Create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to the pre-scan repositories and read access to the post-scan repositories.

Create pre-scan Amazon Elastic Container Registry (Amazon ECR) repositories in each account that publishes container images. Create repositories for post-scan images in the shared services account. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization read access to the post-scan repositories.

Configure image replication for each image from the image's pre-scan repository to the image's post-scan repository.

Create a pipeline in AWS CodePipeline for each pre-scan repository. Create a source stage that runs when new images are pushed to the pre-scan repositories. Create a stage that uses AWS CodeBuild as the action provider. Write a buildspec.yaml definition that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.

Create an AWS Lambda function. Create an Amazon EventBridge rule that reacts to image scanning completed events and invokes the Lambda function. Write function code that determines the image scanning status and pushes images without critical vulnerabilities to the post-scan repositories.

Correct Answer: A, E

To meet the requirements with the least administrative overhead, it is appropriate to create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account. This ensures centralized management. Create separate repositories for pre-scan and post-scan images. Implementing Amazon ECR image scanning to run on new image pushes to the pre-scan repositories ensures all images are scanned per the regulation. Use resource-based policies to control access appropriately. Additionally, creating an AWS Lambda function that is triggered by Amazon EventBridge rules to react to image scanning completed events and push images without critical vulnerabilities to the post-scan repositories minimizes administrative overhead by automating the process after scanning, and avoids the complexity of managing multiple pipelines.

Discussion

tgv

---> AE

trungtdOptions: AE

LEAST administrative overhead: => Should create ECR repositories in the shared services account => A And should create only 1 Lambda function => E D wrong because it involves creating and managing multiple pipelines, which increases administrative overhead significantly

xdkonorek2Options: AE

E > D for LEAST administrative overhead