Amazon ECR Scan on Push for CVE Scanning

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

A Use Amazon ECR as a private image repository and specify scan on push filters to automatically scan for CVEs without modifying ECS workloads.

Question

A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned. Which solution will meet these requirements with the FEWEST changes to the workloads?
  1. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan. Correct Answer
  2. Store the container images in an Amazon S3 bucket. Use Amazon Macie to scan the images. Use an S3 Event Notification to initiate a Macie scan for every event with an s3:ObjectCreated:Put event type.
  3. Deploy the workloads to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository. Specify scan on push filters for the ECR enhanced scan.
  4. Store the container images in an Amazon S3 bucket that has versioning enabled. Configure an S3 Event Notification for s3:ObjectCreated:* events to invoke an AWS Lambda function. Configure the Lambda function to initiate an Amazon Inspector scan.

Key Takeaways

The exam tests your ability to select a native AWS service integration that reduces operational overhead, specifically highlighting that ECR's built-in scanning capability avoids the need for external tools or significant architectural changes.

This question tests the integration of Amazon ECR with ECS to achieve automated container image scanning with minimal workload modifications. It establishes that using ECR as a private repository with 'scan on push' filters is the most efficient solution for identifying Common Vulnerabilities and Exposures (CVEs).

Common mistake: Candidates often choose options involving S3 and Lambda or Inspector because they mistakenly believe these offer more comprehensive security coverage, failing to recognize that the question prioritizes 'fewest changes' over advanced vulnerability detection.

Expert Analysis

Why the Answer Is Correct

Option A is correct because it leverages Amazon Elastic Container Registry (ECR), which is natively integrated with Amazon ECS. By configuring 'scan on push' filters in ECR, images are automatically scanned for Common Vulnerabilities and Exposures (CVEs) upon upload. This requires no changes to the underlying ECS workloads or task definitions, satisfying the 'fewest changes' constraint perfectly.

Why the Other Options Are Wrong

Option B is incorrect because storing container images in S3 is not a standard practice for ECS workloads, and Macie is designed for data discovery (PII/credentials), not container image CVE scanning. Option C is incorrect because migrating from ECS to EKS represents a massive architectural change, violating the 'fewest changes' requirement. Option D involves deploying custom Lambda functions and using Inspector, which adds significant complexity and maintenance overhead compared to the native ECR solution.

Community Comment Notes

Community consensus strongly supports Option A. Users noted that ECR is designed for this exact use case and integrates seamlessly with ECS. One commenter emphasized that 'Basic scan looks for Common Vulnerabilities and Exposures (CVEs)', confirming that ECR Basic Scan meets the specific technical requirement mentioned in the question. Another user pointed out that while Enhanced Scan offers more detail, it would require the EKS migration proposed in Option C, which is too disruptive.

Official Reference

https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions ask for the 'fewest changes' or 'most managed' solution, prioritize native AWS services that integrate directly with the existing architecture. Avoid solutions that involve moving data to unrelated services (like S3 for images) or migrating to different platform types (ECS to EKS) unless explicitly required.

Frequently Asked Questions

Does ECR Basic Scan detect CVEs?

Yes, ECR Basic Scan detects Common Vulnerabilities and Exposures (CVEs) for Linux-based container images.

Why is S3 + Lambda not the best choice?

It requires building and maintaining custom code (Lambda) and managing event notifications, whereas ECR provides a fully managed, native scanning feature.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. 1dd 👍 9 Answered A
    need less workload changes and CVEs https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
  2. xBUGx 👍 6 Answered A
    FEWEST changes to the workloads and scan CVE is enough. A looks OK.
  3. sandordini 👍 5 Answered A
    Basic scan looks for Common Vulnerabilities and Exposures (CVEs)
  4. LeonSauveterre 👍 1 Answered A
    Amazon ECR: Designed for storing container images, integrates seamlessly with Amazon ECS. Scan on Push: Automatically scans images for vulnerabilities (CVEs) when they are uploaded. This is built-in functionality and requires minimal changes to existing workflows. Fewest Changes: Existing ECS workloads can directly pull images from ECR without modification to the workloads themselves. B - Amazon Macie focuses on data discovery and classification (such as identifying sensitive data in S3 buckets), not container image vulnerabilities. C - Result-wise OK, but switching from ECS to EKS is unnecessary and involves a steep learning curve and operational overhead. D - Result-wise OK. Amazon Inspector can scan for vulnerabilities, but this is too complex and requires a custom setup, including using S3 and Lambda to trigger scans.
  5. zdi561 👍 1 Answered D
    A is not right because ECR basic scan only scan OS. in B enhanced scan does scan app packages but it is required to run EKS. D is simpler.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide