Container images must be scanned continuously for new CVEs, including images pushed months ago. What should be enabled?
Show answer and explanation
Answer: B
ECR enhanced scanning — powered by Amazon Inspector — continuously rescans all pushed images as new CVEs appear, so an image stored months ago gets re-evaluated and reintegrated findings without ever being re-pushed. That's exactly the continuous coverage the requirement describes.
Why the other options are wrong
- A. Basic scanning only scans at push time (or on manual request); an image pushed once last year is never re-checked as new CVEs are published.
- C. GuardDuty EKS protection looks for runtime threat signals in EKS clusters, not CVEs in stored container images.
- D. Macie finds sensitive data in S3; it has nothing to do with container image scanning.