A software vendor ships regulated container images weekly through CodePipeline, needing automated OS vulnerability scans on every push, blocking of critical findings, and cryptographic signing before production deployment. Audit requires scan evidence and image provenance. Which pipeline security scanning for vulnerabilities and artifact signing should the architect configure?

The correct design succeeds because ECR enhanced scanning with Inspector automatically scans each pushed image for OS vulnerabilities and continuously re-evaluates as new CVEs emerge, generating detailed findings that satisfy scan evidence and support a pipeline rule to block critical severity, while Signer signatures provide cryptographic attestation and verification before production promotion to prove provenance for audit. The immutable-tag design fails by concept because preventing tag overwrite ensures integrity against replacement but cannot prove publisher identity or build integrity the way cryptographic signing does, so provenance remains incomplete for regulated audit. The basic-scanning design fails by concept because basic scanning checks OS packages on push but lacks Inspector enhanced coverage, continuous reassessment, and rich evidentiary scoring required for reliable blocking and compliance reporting. The waiver-permitting design fails by concept because allowing promotion with approved exceptions converts mandatory blocking into risk acceptance, violating the explicit requirement to prevent critical findings from reaching production. For exam strategy, remember that monitoring, archiving findings, or immutability often look sufficient but do not equal enforced blocking plus signing, and questions emphasize gate behavior on critical severity. As a practical check, test the pipeline with a deliberately vulnerable image to confirm the scan stage fails and unsigned images are rejected at the production promotion action, and archive Inspector reports with Signer attestations linked to pipeline execution IDs.