Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 808 discussion

need less workload changes and CVEs https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html

FEWEST changes to the workloads and scan CVE is enough. A looks OK.

A is not right because ECR basic scan only scan OS. in B enhanced scan does scan app packages but it is required to run EKS. D is simpler.

Amazon ECR: Designed for storing container images, integrates seamlessly with Amazon ECS. Scan on Push: Automatically scans images for vulnerabilities (CVEs) when they are uploaded. This is built-in functionality and requires minimal changes to existing workflows. Fewest Changes: Existing ECS workloads can directly pull images from ECR without modification to the workloads themselves. B - Amazon Macie focuses on data discovery and classification (such as identifying sensitive data in S3 buckets), not container image vulnerabilities. C - Result-wise OK, but switching from ECS to EKS is unnecessary and involves a steep learning curve and operational overhead. D - Result-wise OK. Amazon Inspector can scan for vulnerabilities, but this is too complex and requires a custom setup, including using S3 and Lambda to trigger scans.

Basic scan looks for Common Vulnerabilities and Exposures (CVEs)