Which statement applies to optimization of registry scans with version pattern matching?

Registry scan optimization using version pattern matching or limiting scans to the latest images is a performance-tuning feature. It is specifically designed for environments with extremely large-scale container registries. In such scenarios, where there might be tens of thousands of repositories and millions of images, scanning every single tagged image becomes computationally expensive and time-consuming. This feature allows security teams to focus scanning efforts on the most relevant or newest images, significantly reducing scan time and resource consumption without a proportional loss in security posture, assuming a sound image lifecycle management process is in place.

A. The need for this optimization is based on the scale of the registry, not the specific operating system (like Linux) of the container images.
C. This is not a universal best practice. In smaller environments, a full scan is preferable for comprehensive coverage. Misconfiguring this feature could lead to unscanned images and security blind spots.
D. The optimization mechanism is based on image tags and digests, which are fundamental container concepts and are OS-agnostic. It works equally well for Windows and Linux images.

1. Palo Alto Networks Prisma Cloud Administrator's Guide (Compute): In the section "Registry Scans," under "Add a Registry Scan" and "Advanced settings," the feature "Scan only latest" is described. The documentation explicitly states, "For very large registries, scanning can be a lengthy process. To reduce scan time, you can configure Prisma Cloud to scan only the latest n images in each repository." This directly supports the notion that the feature is intended for large-scale environments. (Reference: Prisma Cloud Administrator's Guide (Compute) > Defend > Vulnerabilities > Manage Scans > Registry Scans).