Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A healthcare technology company runs its patient portal on a fleet of Amazon EC2 instances. The security compliance officer needs to ensure that the operating systems of these instances are regularly checked for software vulnerabilities and unintended network exposure. According to the AWS Shared Responsibility Model, which customer-managed action should the company take to meet this requirement?

  1. Configure Amazon Inspector to automatically scan the EC2 instances.Answer
  2. B
    Rely on AWS to manage and patch the operating system vulnerabilities of the EC2 instances.
  3. C
    Enable Amazon GuardDuty to detect and patch the EC2 operating system vulnerabilities.
  4. D
    Review AWS CloudTrail event logs to identify and remove outdated software packages.

Answer

Configure Amazon Inspector to automatically scan the EC2 instances.
Configuring Amazon Inspector is the correct action because it is AWS's automated vulnerability management service. It continuously scans EC2 instances and ECR container images for software vulnerabilities and unintended network reachability.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to regularly check the EC2 instance operating systems for software vulnerabilities and network exposure.
Understanding whether the task involves active threat detection (log analysis) or software vulnerability/configuration scanning determines the correct AWS security tool.
2
Determine the boundary of responsibility under the Shared Responsibility Model.
The guest operating system and applications running on Amazon EC2 instances fall under the customer's responsibility (Security 'in' the Cloud).
AWS does not manage or scan guest operating systems automatically; the customer must select and configure a service like Amazon Inspector to perform these tasks.
3
Select the appropriate AWS service for vulnerability scanning.
Amazon Inspector is chosen because it specifically scans EC2 instances and ECR images for software vulnerabilities and unintended exposure.
Other services like Amazon GuardDuty (threat detection) and AWS CloudTrail (API logging) do not scan for OS-level software vulnerabilities.

Key Concept

Amazon Inspector is the native AWS service for automated vulnerability management, scanning EC2 instances and container images for software vulnerabilities and network path exposure. Under the Shared Responsibility Model, securing the guest operating system is the customer's responsibility.
Estimated Time:1m 0s
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic