Amazon DVA-C02 Exam - Topic 1 Question 4 Discussion

Actual exam question for Amazon's DVA-C02 exam

Question #: 4
Topic #: 1

A company needs to harden its container images before the images are in a running state. The company's application uses Amazon Elastic Container Registry (Amazon ECR) as an image registry. Amazon Elastic Kubernetes Service (Amazon EKS) for compute, and an AWS CodePipeline pipeline that orchestrates a continuous integration and continuous delivery (CI/CD) workflow.

Dynamic application security testing occurs in the final stage of the pipeline after a new image is deployed to a development namespace in the EKS cluster. A developer needs to place an analysis stage before this deployment to analyze the container image earlier in the CI/CD pipeline.

Which solution will meet these requirements with the MOST operational efficiency?

ABuild the container image and run the docker scan command locally. Mitigate any findings before pushing changes to the source code repository. Write a pre-commit hook that enforces the use of this workflow before commit.

BCreate a new CodePipeline stage that occurs after the container image is built. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings.

CCreate a new CodePipeline stage that occurs after source code has been retrieved from its repository. Run a security scanner on the latest revision of the source code. Fail the pipeline if there are findings.

DAdd an action to the deployment stage of the pipeline so that the action occurs before the deployment to the EKS cluster. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings.

Show Suggested Answer

Suggested Answer: D

by Amie at Mar 21, 2023, 08:48 AM

Limited Time Offer

25%

Off

Get Premium DVA-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Cruz

4 months ago

C doesn't address the container image specifically, so it’s not ideal.

upvoted 0 times

...

Mable

4 months ago

B is solid, but I wonder if the Lambda function adds too much complexity.

upvoted 0 times

...

Sol

4 months ago

Surprised that local scans aren't more common in these setups!

upvoted 0 times

...

Vivan

4 months ago

I disagree, I think D could work just as well.

upvoted 0 times

...

Desmond

4 months ago

Option B seems like the best choice for efficiency.

upvoted 0 times

...

Kaycee

5 months ago

Option C sounds interesting, but I’m not sure if scanning the source code instead of the image is the best approach. I feel like we should focus on the final image.

upvoted 0 times

...

Lai

5 months ago

I’m leaning towards option B as well, but I wonder if there are any drawbacks to adding another stage in the pipeline. It could slow things down, right?

upvoted 0 times

...

Stephanie

5 months ago

I think we practiced a similar question where we had to decide when to scan images. I feel like option A might be too manual since it requires local scanning before pushing.

upvoted 0 times

...

Della

5 months ago

I remember we discussed the importance of scanning images early in the pipeline. Option B seems to fit that, but I'm not sure if using Lambda is the most efficient way.

upvoted 0 times

...

Lelia

5 months ago

I recall a practice question similar to this, and I think option D could work, but it seems like it might complicate the deployment stage unnecessarily.

upvoted 0 times

...

Earleen

5 months ago

I feel like option C is a bit off-topic since it focuses on source code rather than the container image itself.

upvoted 0 times

...

Daren

5 months ago

I think option B makes sense since it scans right after the image is built, but I wonder if it adds too much overhead to the pipeline.

upvoted 0 times

...

Cortney

5 months ago

I remember we discussed the importance of scanning images early in the pipeline, but I'm not sure if option B or D is better for operational efficiency.

upvoted 0 times

...

Annabelle

5 months ago

Ah yes, that makes sense. Automated unit testing is also important, but the question is specifically about the focus of test automation in a regression-averse approach.

upvoted 0 times

...

Ciara

5 months ago

This question seems straightforward, I'm pretty confident I can identify the correct statement about packet-based analysis.

upvoted 0 times

...