Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A software-as-a-service (SaaS) provider wants to implement Amazon Inspector to enhance the security posture of its application hosting environment. Which of the following tasks can Amazon Inspector perform to assist the provider with vulnerability management? (Select two.)

  1. Scanning software packages on running Amazon EC2 instances for known vulnerabilitiesAnswer
  2. Scanning container images stored in Amazon Elastic Container Registry (Amazon ECR) for package vulnerabilitiesAnswer
  3. C
    Analyzing AWS CloudTrail logs to detect anomalous API activity and potential credential compromise
  4. D
    Automatically applying security patches to the operating systems of EC2 instances
  5. E
    Monitoring and aggregating CPU and memory utilization metrics of active EC2 instances

Answer

The correct tasks are scanning software packages on running Amazon EC2 instances for known vulnerabilities, and scanning container images stored in Amazon Elastic Container Registry (Amazon ECR) for package vulnerabilities.
Amazon Inspector is a vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It supports automated scanning of software packages installed on running Amazon EC2 instances and container images pushed to Amazon Elastic Container Registry (Amazon ECR).

Step-by-Step Solution

1
Identify the primary capability of Amazon Inspector.
Amazon Inspector is an automated vulnerability management service designed to scan workloads for software vulnerabilities and unintended network exposure.
This helps determine which options align with vulnerability scanning vs other security activities.
2
Evaluate the workload scanning targets supported by Amazon Inspector.
Amazon Inspector supports scanning Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions.
This matches the options for EC2 package scanning and ECR container image scanning as the correct tasks.
3
Differentiate Amazon Inspector from other security services and user responsibilities.
Anomalous API activity log analysis is performed by Amazon GuardDuty. Applying OS patches is a customer responsibility under the Shared Responsibility Model. Metric monitoring is done by Amazon CloudWatch.
This eliminates the distractors based on the correct division of services and responsibilities.

Key Concept

Amazon Inspector automated vulnerability scanning for EC2 workloads and container images
Estimated Time:1m 30s
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic