Contoso Retail uses Amazon ECR and deploys to Amazon ECS. Security mandates that no image with High or Critical CVEs can be promoted to production. They want automated enforcement in their CI/CD pipeline with minimal manual steps. Which combination of actions will meet these requirements? (Choose two.)

Enabling Amazon ECR enhanced scanning (Amazon Inspector) with scan on push ensures that images are automatically scanned for vulnerabilities upon upload. This provides the necessary security findings. Adding a CodeBuild stage to query these scan results for the image digest and fail the build if High/Critical findings exist before updating the ECS task definition provides the automated enforcement. This stops the deployment of non-compliant images to production. Blocking image pulls (an ECR repository setting) would prevent all environments from pulling the image, which might be too restrictive if lower environments can tolerate some vulnerabilities. The ECS deployment circuit breaker stops tasks after they are deployed, not before, so it doesn't prevent non-compliant images from reaching production. Deleting images with an ECR lifecycle policy would remove them entirely, which is not ideal for auditing or potential remediation, and doesn't directly prevent deployment.