Skill 4.3.1: Secure continuous integration and continuous delivery (CI/CD) pipelines by checking for code and image vulnerabilities
| Question | Answer & Explanation |
|---|---|
| ### Question 1 - Scanning ML Application Code for Secrets and Vulnerabilities An enterprise ML team is building a CI/CD pipeline using AWS CodePipeline to deploy a custom Scikit-Learn inference container to Amazon SageMaker. The application source code contains complex data transformation logic, and the team wants to detect hardcoded AWS credentials and potential security vulnerabilities in the Python code before deployment. The pipeline must operate with the least operational overhead. Which AWS service should the team use to fulfill this requirement? (Select ONE) - A) Use Amazon Inspector to scan the application source code repository. - B) Use Amazon CodeGuru Security to scan the application source code. - C) Use AWS Lambda to run Bandit scans on the code in the Build stage. - D) Use Amazon Macie to scan the AWS CodeCommit repository for sensitive data. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon CodeGuru Security is an automated static analysis service that identifies security vulnerabilities, hardcoded secrets, and AWS best practice violations directly within the application source code. It requires no custom infrastructure to manage, fitting the least operational overhead constraint. Distractor Analysis: - A is Incorrect: Amazon Inspector scans running compute workloads (EC2, ECR images, Lambda functions) for software vulnerabilities and network exposure, not raw text source code files. - C is Incorrect: Writing a custom AWS Lambda function to run Bandit introduces unnecessary operational overhead compared to the fully managed CodeGuru Security service. - D is Incorrect: Amazon Macie is designed to discover and protect sensitive data (like PII) stored in Amazon S3, not to scan source code repositories for hardcoded credentials or code-level security vulnerabilities. > Exam Tip: CodeGuru Security is for static analysis of source code (finding secrets, bad logic, vulnerabilities), while Inspector is for dynamic/runtime analysis of built artifacts (EC2, ECR, Lambda). |
| ### Question 2 - Scanning Custom ML Docker Images for CVEs A generative AI startup packages its custom Triton inference server into a Docker image stored in Amazon Elastic Container Registry (Amazon ECR). The CI/CD pipeline, managed by AWS CodePipeline, must ensure that the base operating system and the Python packages bundled in the image do not contain known Common Vulnerabilities and Exposures (CVEs) before deploying the image to Amazon SageMaker. The solution must require minimal operational overhead. Which AWS service fulfills this requirement? (Select ONE) - A) Amazon CodeGuru Security - B) Amazon Inspector - C) AWS Config - D) AWS CloudTrail |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Inspector continuously scans container images pushed to Amazon ECR for known software vulnerabilities (CVEs) in operating system packages and application dependencies. It is fully managed and requires no infrastructure to maintain. Distractor Analysis: - A is Incorrect: Amazon CodeGuru Security analyzes raw source code text, not compiled binaries or assembled Docker container image layers. - C is Incorrect: AWS Config records resource configurations over time and evaluates them against compliance rules; it does not perform deep CVE scanning on container image payloads. - D is Incorrect: AWS CloudTrail records API audit logs for account activity; it does not inspect the contents of container images for software vulnerabilities. > Exam Tip: To scan a built Docker image in ECR for OS or package vulnerabilities, use Amazon Inspector (often configured via ECR enhanced scanning). |
| ### Question 3 - Automated Code Reviews for ML Pull Requests A financial institution is automating its ML model deployment process. The data scientists push their training scripts to an AWS CodeCommit repository. The DevOps team needs to automatically review the code for best practices, potential race conditions, and resource leaks every time a pull request is created. The solution must require the least amount of custom code to maintain. Which AWS service should be used to meet these requirements? (Select ONE) - A) Configure Amazon CodeGuru Reviewer to analyze the pull requests. - B) Configure Amazon Inspector to run on the EC2 instances executing the CI/CD. - C) Create a custom SonarQube pipeline in AWS CodeBuild. - D) Use Amazon Macie to scan the CodeCommit repository for sensitive data. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Amazon CodeGuru Reviewer uses machine learning to automatically analyze pull requests in CodeCommit (and GitHub) to provide intelligent recommendations for code quality, best practices, and identifying resource leaks or race conditions with zero custom infrastructure. Distractor Analysis: - B is Incorrect: Amazon Inspector is for scanning compute workloads for vulnerabilities, not for reviewing source code logic or best practices in a pull request. - C is Incorrect: While SonarQube can perform code reviews, setting it up in CodeBuild requires managing the SonarQube server and integration, which violates the "least amount of custom code/maintenance" constraint. - D is Incorrect: Amazon Macie is for data discovery in S3, not for code logic analysis in CodeCommit. > Exam Tip: Use Amazon CodeGuru Reviewer for automated code quality and best practice reviews on pull requests. |
| ### Question 4 - Continuous Scanning of Serverless ML Preprocessing Functions An e-commerce company has a serverless ML architecture where an AWS Lambda function receives user clickstream data, preprocesses it, and invokes an Amazon SageMaker endpoint for real-time inference. The security team mandates that the Lambda function code must be continuously scanned for software vulnerabilities and unintended network exposure. Which AWS service should the DevOps engineer enable to fulfill this requirement? (Select ONE) - A) Amazon CodeGuru Security - B) Amazon Inspector - C) AWS Config - D) Amazon GuardDuty |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Inspector supports the automated and continuous scanning of AWS Lambda functions, identifying software vulnerabilities in the deployment packages and detecting unintended network exposure. Distractor Analysis: - A is Incorrect: CodeGuru Security performs static analysis on source code, but does not continuously scan deployed Lambda runtime environments for network exposure or dependency CVEs. - C is Incorrect: AWS Config evaluates resource configuration states against rules, but does not perform deep package vulnerability scanning on Lambda deployment artifacts. - D is Incorrect: Amazon GuardDuty is an intelligent threat detection service that monitors for malicious activity and unauthorized behavior, not a software vulnerability scanner for Lambda packages. > Exam Tip: Remember that Amazon Inspector covers three main targets: EC2 instances, ECR container images, and Lambda functions. |
| ### Question 5 - Enforcing Security Gates in CodePipeline for ML Images A healthcare company is building a SageMaker pipeline that includes a custom TensorFlow training container. The DevOps engineer wants to enforce a security gate in their AWS CodePipeline. If the Docker image built in the pipeline's Build stage (AWS CodeBuild) contains critical vulnerabilities, the pipeline must automatically stop and prevent deployment to Amazon ECR and SageMaker. The solution must minimize operational overhead. What is the most operationally efficient way to implement this? (Select ONE) - A) Manually trigger Amazon Inspector from CodeBuild using the CLI, and parse the JSON output in a script to stop the pipeline. - B) Enable Amazon ECR enhanced scanning with Amazon Inspector and configure the pipeline to fail if critical vulnerabilities are found. - C) Use Amazon CodeGuru Security to scan the Dockerfile for vulnerable base images. - D) Deploy AWS Firewall Manager to inspect the network traffic of the CodeBuild container. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Enabling Amazon ECR enhanced scanning (powered by Amazon Inspector) automatically scans images upon push to ECR. By integrating ECR scan results as a manual approval gate or automated failure condition in CodePipeline, the pipeline can be blocked with minimal custom logic. Distractor Analysis: - A is Incorrect: While technically possible, writing custom scripts to trigger Inspector and parse JSON in CodeBuild introduces unnecessary operational overhead compared to native ECR scanning integration. - C is Incorrect: CodeGuru Security does not analyze Dockerfiles for vulnerable base images; it analyzes application source code. - D is Incorrect: AWS Firewall Manager is used to manage network firewall rules across accounts, not to scan container images for vulnerabilities. > Exam Tip: ECR enhanced scanning uses Inspector to continuously scan images. Native integration allows CodePipeline to fail a stage based on the scan findings. |
| ### Question 6 - Dual-Scan Approach for ML CI/CD Pipelines A global retail company is deploying an ML model using a custom Docker container. The security team requires a dual-scan approach in the CI/CD pipeline: one scan for hardcoded secrets in the application code, and a separate scan for known vulnerable packages in the built Docker image. The pipeline must minimize operational overhead and use native AWS services. Which combination of services should the DevOps engineer use? (Select TWO) - A) Amazon Macie for code - B) Amazon CodeGuru Security for code - C) Amazon Inspector for the image - D) AWS Config for code - E) Amazon GuardDuty for the image |
Correct Answer: B and C Correct Answer Analysis: - B is Correct: Amazon CodeGuru Security is the native AWS service for static analysis of source code, including detecting hardcoded credentials and security vulnerabilities. - C is Correct: Amazon Inspector (specifically through Amazon ECR image scanning) is the native AWS service for scanning built container images for known package and OS vulnerabilities (CVEs). Distractor Analysis: - A is Incorrect: Amazon Macie scans S3 data for PII, not source code for secrets. - D is Incorrect: AWS Config monitors configuration states, not source code secrets. - E is Incorrect: Amazon GuardDuty monitors for malicious activity and threats, not container image package vulnerabilities. > Exam Tip: Security pipelines need both: CodeGuru Security for what was written (code), and Inspector for what was assembled (image). |
| ### Question 7 - Securing Pull Requests in an ML Pipeline An ML engineering team has configured an AWS CodePipeline that pulls source code from GitHub, builds a custom inference container using AWS CodeBuild, and deploys it to Amazon SageMaker. The team wants to implement automated security reviews on the pull requests before the build stage initiates. They need a service that specifically provides recommendations for improving code quality and security based on AWS best practices. Which service meets this requirement? (Select ONE) - A) Amazon Inspector - B) Amazon CodeGuru Reviewer - C) AWS Secrets Manager - D) Amazon GuardDuty |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon CodeGuru Reviewer connects to GitHub (and CodeCommit) to automatically provide intelligent code reviews on pull requests, identifying code quality issues, security vulnerabilities, and AWS best practice violations. Distractor Analysis: - A is Incorrect: Amazon Inspector scans compute workloads (EC2, ECR, Lambda), not GitHub pull requests for code quality. - C is Incorrect: AWS Secrets Manager stores and rotates secrets; it does not review code. - D is Incorrect: Amazon GuardDuty is a threat detection service for monitoring malicious activity, not a code analysis tool. > Exam Tip: CodeGuru Reviewer provides automated code quality reviews on pull requests, while CodeGuru Security focuses specifically on finding security vulnerabilities and secrets. |
| ### Question 8 - Orchestration of SageMaker Training Jobs via Lambda An enterprise is using a continuous integration and continuous delivery (CI/CD) pipeline to deploy AWS Lambda functions that orchestrate Amazon SageMaker training jobs. The security policy dictates that the Lambda deployment package must be evaluated for vulnerabilities after it is published, but before it is routed to production traffic. Which feature of Amazon Inspector should the DevOps engineer utilize to fulfill this requirement? (Select ONE) - A) Amazon Inspector ECR image scanning - B) Amazon Inspector Lambda function scanning - C) Amazon Inspector EC2 scanning - D) Amazon Inspector network reachability scanning |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Inspector natively supports scanning AWS Lambda functions and their deployment packages (zip files) for software vulnerabilities in the code dependencies. Distractor Analysis: - A is Incorrect: ECR image scanning is for Docker containers, not Lambda zip deployment packages. - C is Incorrect: EC2 scanning is for virtual machine instances, not serverless Lambda functions. - D is Incorrect: While Inspector does evaluate network reachability, the requirement specifically asks to evaluate the Lambda function package for vulnerabilities (CVEs), not just its network exposure. > Exam Tip: Inspector Lambda function scanning evaluates the application dependencies within the Lambda deployment package. |
| ### Question 9 - Remediating Inspector Findings in Lambda ML Workflows A data science team is using AWS Step Functions to orchestrate a complex ML workflow. Part of the workflow involves an AWS Lambda function that validates data schemas. The DevOps team has enabled Amazon Inspector for the Lambda function. During a routine scan, Inspector identifies a critical vulnerability in a third-party library (e.g., pandas) packaged within the Lambda deployment zip file.What is the most operationally efficient way to resolve this finding? (Select ONE) - A) Modify the Lambda function code to remove the pandas library. - B) Update the library version in the CI/CD pipeline's requirements.txt file, rebuild the deployment package, and redeploy the Lambda function. - C) Apply an AWS Config rule to automatically patch the Lambda function in place. - D) Enable Amazon Inspector automatic remediation to patch the library in the Lambda package. |
Correct Answer: B Correct Answer Analysis: - B is Correct: AWS Lambda functions are immutable. To fix a vulnerability in a dependency, you must update the dependency version in the source pipeline, rebuild the deployment package (zip file), and deploy a new version of the Lambda function. Distractor Analysis: - A is Incorrect: The Lambda function relies on the pandas library for schema validation; removing it would break the application logic. - C is Incorrect: AWS Config rules evaluate configuration compliance but cannot automatically patch code dependencies inside a Lambda zip file. - D is Incorrect: Amazon Inspector does not provide automatic remediation or patching of Lambda packages; it only identifies the vulnerabilities. > Exam Tip: Inspector identifies vulnerabilities but does not patch them. Lambda packages are immutable; fix dependencies in the CI/CD pipeline and redeploy. |
| ### Question 10 - Comprehensive Code and Image Scanning in CodePipeline A DevOps engineer is setting up an AWS CodePipeline for a machine learning application. The pipeline uses AWS CodeBuild to compile the ML inference code and build a Docker image. The security team requires that the pipeline must check for code vulnerabilities and secrets, and then check the built Docker image for OS package vulnerabilities. The engineer wants to use Amazon CodeGuru and Amazon Inspector to fulfill these requirements with the least operational overhead. Which combination of steps should the engineer take? (Select ONE) - A) Add a CodeGuru Security action to the Source stage, and enable Amazon ECR enhanced scanning using Amazon Inspector on the registry. - B) Add Amazon Inspector to the Source stage to scan the code, and add Amazon CodeGuru Security to the Build stage to scan the image. - C) Add an AWS Lambda function in the Build stage to run Trivy on the code, and use CodeGuru to scan the image. - D) Use AWS Config to monitor the CodePipeline for vulnerabilities. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Amazon CodeGuru Security can be integrated directly into the Source stage of CodePipeline to scan source code as it is pulled. Amazon ECR enhanced scanning (which uses Amazon Inspector) automatically scans the Docker image when CodeBuild pushes it to ECR in the Build stage. Distractor Analysis: - B is Incorrect: The roles are reversed. Amazon Inspector scans images, not raw source code. CodeGuru Security scans code, not images. - C is Incorrect: This introduces custom code (Lambda running Trivy) and uses the wrong service (CodeGuru for images), violating the "least operational overhead" and correct service usage constraints. - D is Incorrect: AWS Config evaluates resource configuration compliance, not deep code and image vulnerabilities. > Exam Tip: Map the tool to the pipeline stage: CodeGuru Security integrates with the Source stage for code, while ECR/Inspector scanning integrates with the Build stage for images. |