SAP-C03 practice question: Pipeline security scanning, signing and AI evaluation (1 of 2)
Operational Excellence and Automation A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A news publisher builds its container images with AWS CodeBuild and stores them in Amazon ECR. Its security team found that images are scanned only once, when pushed, and a critical package vulnerability published a week later went unnoticed in a deployed image.
The security team wants images scanned continuously after they are pushed, with a deployment blocked when an image has a critical finding in its operating system or application packages. The team wants no new scanning servers to manage.
Which solution meets these requirements?
Choose one answer.
AA. Enable Amazon ECR enhanced scanning, which uses Amazon Inspector to rescan images continuously, and add a pipeline step that blocks the deployment when an image has a critical finding.
BB. Keep basic scanning on the repositories, and have an engineer review the scan report for each image once a month before the next release.
CC. Run an open-source scanner on a fleet of EC2 instances that pulls every image from the registry each night, and have the scanner's results written to a shared report for the security team.
DD. Add a scan step to the build that fails only when the build itself errors, and let the deploy stage run whatever image the build produced.
Show the answer and explanation
Answer: A
A. Right: Correct. Enhanced scanning through Inspector rescans images as new vulnerabilities are published, and the pipeline check blocks any image with a critical finding. AWS runs the scanning, so no servers need managing.
B. Wrong: Basic scanning runs at push time and does not rescan for newly published vulnerabilities. A monthly manual review is too slow to catch a week-old critical finding.
C. Wrong: The fleet has to be built, patched and scaled by the team, which the security team wants to avoid. A shared file also does not block a deployment on its own.
D. Wrong: A build error does not reflect the vulnerabilities in the packages, so critical findings still reach production. The option does not block anything on the scan result.
Explanation
Enhanced scanning through Inspector rescans images after they are pushed, and a pipeline check on the findings blocks deployments with critical issues without any scanning servers. Basic push-time scans, monthly reviews, self-run scanners and build-only checks each miss the continuous or blocking requirement.
Want more on Pipeline security scanning, signing and AI evaluation? The 5 full-length practice sets have 7 more Pipeline security scanning, signing and AI evaluation questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →