A team pushes container images to ECR and wants vulnerabilities detected automatically on push and continuously as new CVEs publish. What should they use?
A.Amazon GuardDuty
GuardDuty detects threats in activity/telemetry, not software vulnerabilities in images.
B.Amazon Inspector with ECR scanning
Correct. Inspector is the vulnerability-management service for ECR, EC2, and Lambda.
C.AWS Config managed rules
Config tracks resource configuration compliance — not CVE detection.
D.Amazon Macie
Macie finds sensitive data in S3, unrelated to image CVEs.
Why this answer
Amazon Inspector scans ECR images (basic scan-on-push and enhanced continuous scanning that re-evaluates images when new CVEs appear) and surfaces findings to Security Hub.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security