Examkin

Question

Difficulty: HardThreat Detection and Vulnerability Management

A health-tech organization needs to secure its AWS environment to meet compliance standards. The compliance team requires the organization to implement a mechanism that records all historical API activities to identify who made specific configuration changes to security groups, and also run automated scans on their Amazon EC2 instances to check for known software vulnerabilities and package exposures. Which combination of AWS services or responsibility frameworks will meet these requirements?

  1. A
    AWS CloudTrail to record API activity, and Amazon GuardDuty to scan Amazon EC2 instances for software vulnerabilities.
  2. AWS CloudTrail to record API activity, and Amazon Inspector to scan Amazon EC2 instances for software vulnerabilities.Answer
  3. C
    Amazon CloudWatch to record API activity, and Amazon GuardDuty to scan Amazon EC2 instances for software vulnerabilities.
  4. D
    AWS CloudTrail to record API activity, and rely on AWS to automatically scan and patch the guest operating systems of the Amazon EC2 instances.

Answer

The combination of AWS CloudTrail to record API activity and Amazon Inspector to scan Amazon EC2 instances for software vulnerabilities.
The correct answer combines AWS CloudTrail and Amazon Inspector. AWS CloudTrail records and logs AWS API calls, enabling auditing of modifications to security configurations such as security groups. Amazon Inspector is the service that automatically assesses EC2 instances for software vulnerabilities (CVEs) and unintended network exposure.

Step-by-Step Solution

1
Identify the requirement for tracking and auditing API configuration history.
Determine that AWS CloudTrail is the service responsible for auditing and logging AWS API calls and user activities.
AWS CloudTrail tracks actions taken by a user, role, or an AWS service, which allows the security team to audit who modified the security groups.
2
Identify the requirement for automated vulnerability scanning on Amazon EC2 instances.
Determine that Amazon Inspector is designed to automatically scan EC2 instances for software vulnerabilities (CVEs) and network reachability.
Amazon Inspector continuously scans workloads for software vulnerabilities, whereas GuardDuty focuses on active threat detection, and guest OS security is the customer's responsibility.

Key Concept

Auditing API activity using AWS CloudTrail and managing EC2 software vulnerabilities using Amazon Inspector under the AWS Shared Responsibility Model.
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic