AmazonAmazon DevOps Engineer Professional DOP-C02 Certification·EN·Updated 4 Aug 2026
A company is migrating container workloads into a multi-account AWS Organizations setup. Application accounts run the workloads; a shared services account hosts centralized services. Compliance requires every container image to be scanned before deployment, images with no critical vulnerabilities may be consumed downstream, and pre-scan and post-scan images must be isolated so deployments cannot use pre-scan images. Which pair of steps centralizes this workflow with the least admin overhead? (Choose two.)
Choose an answer
Tap an option to check your answer.
Correct answer: Create ECR repositories in the shared services account: for each image create a pre-scan repo and a post-scan repo. Enable ECR image scanning on pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to pre-scan repos and read access to post-scan repos., Create a Lambda and an EventBridge rule that triggers on image-scanning completed events. Implement Lambda logic to check scan status and push images without critical vulnerabilities to the post-scan repositories..
Why this is the answer
The first correct option centralizes ECR repositories in the shared services account, simplifying management and access control. Creating separate pre-scan and post-scan repositories enforces isolation, preventing accidental deployment of unscanned images. Enabling ECR image scanning on push automates the vulnerability assessment. Resource-based policies grant necessary cross-account permissions efficiently.
The second correct option automates the promotion of images. An EventBridge rule triggers a Lambda function upon scan completion. The Lambda then programmatically checks the scan results for critical vulnerabilities and, if none