The correct answer is Deploy production images using the "latest" tag.

Using the "latest" tag for production images is not recommended because it makes the deployed artifact ambiguous and non repeatable. If the tag is moved or overwritten you cannot be sure which exact image is running and that makes debugging and auditing much harder.

Production workflows benefit from immutable references and clear versioning. Pinning to image digests or explicit version tags ensures reproducible deployments and safe rollbacks, and avoids surprises that come from automatically changing content when the same tag is reused.

Use an image registry that provides automated vulnerability scanning is not correct because automated scanning is a recommended practice. Scanning helps detect known vulnerabilities before images are promoted to production.

Store images in a private registry with access controls is not correct because using a private registry and controlling access reduces the attack surface and prevents unauthorized image pushes and pulls.

Tag images using semantic versioning for each release is not correct because semantic versioning provides clear intent and traceability for releases and it supports predictable deployment and rollbacks.

Full AWS Practitioner Certification Question