Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A hospitality booking portal hosts its application on Amazon EC2 instances and stores container images in Amazon Elastic Container Registry (ECR). The security team wants to continuously monitor their AWS accounts for malicious activity and unauthorized behavior, while also automatically scanning the EC2 instances and container images for software vulnerabilities.

Which two AWS services should the company use to meet these requirements? (Select two.)

  1. Amazon Inspector to scan the Amazon EC2 instances and Amazon ECR container images for software vulnerabilitiesAnswer
  2. Amazon GuardDuty to perform intelligent threat detection and continuous monitoring for malicious activityAnswer
  3. C
    AWS CloudTrail to monitor system performance metrics and resource logs on the EC2 instances
  4. D
    Amazon CloudWatch to record and audit all API operations and user activity within the AWS account
  5. E
    AWS Systems Manager to manage guest operating system updates, as these are managed automatically by AWS

Answer

Amazon Inspector and Amazon GuardDuty
The service that scans Amazon EC2 instances and Amazon ECR container images for software vulnerabilities is Amazon Inspector. The service that provides intelligent threat detection and continuous monitoring for malicious activity is Amazon GuardDuty.

Step-by-Step Solution

1
Identify the requirement for software vulnerability scanning on Amazon EC2 instances and ECR container images.
Amazon Inspector is identified as the appropriate AWS service designed for automated vulnerability management and scanning of EC2 instances and ECR images.
It identifies software vulnerabilities and unintended network exposure.
2
Identify the requirement for intelligent threat detection and continuous monitoring for malicious activity across AWS accounts.
Amazon GuardDuty is identified as the appropriate AWS service for intelligent threat detection.
It analyzes data sources like VPC Flow Logs, CloudTrail logs, and DNS logs using machine learning to detect unauthorized or malicious behavior.

Key Concept

Differentiating AWS threat detection and vulnerability management services under the Shared Responsibility Model.
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic