Examkin

Question

Difficulty: HardThreat Detection and Vulnerability Management

A healthcare technology company deploys microservices using AWS Lambda and container images stored in Amazon Elastic Container Registry (Amazon ECR). The security team needs to implement a solution that automatically scans these container images and Lambda functions for software vulnerabilities, and assesses the Lambda functions for unintended network exposure. Which AWS service should the company use to meet these requirements?

  1. Amazon InspectorAnswer
  2. B
    Amazon GuardDuty
  3. C
    AWS CloudTrail
  4. D
    AWS Support under the Shared Responsibility Model

Answer

Amazon Inspector
Amazon Inspector is the AWS service designed to automatically and continuously scan workloads—specifically Amazon EC2 instances, Amazon ECR container images, and AWS Lambda functions—for software vulnerabilities (such as Common Vulnerabilities and Exposures, or CVEs) and unintended network path exposure. This directly addresses the requirement to scan container images and Lambda functions.

Step-by-Step Solution

1
Analyze the business and technical requirements of the scenario.
The company needs automated scanning of container images in Amazon ECR and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.
Understanding the target resource types (ECR and Lambda) and the activity (vulnerability scanning and network exposure analysis) narrows down the appropriate AWS security services.
2
Evaluate the capabilities of Amazon Inspector.
Amazon Inspector is designed specifically to scan EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and network reachability.
This matches the exact requirements specified in the scenario.
3
Differentiate Amazon Inspector from threat detection and logging services.
Amazon GuardDuty provides threat detection (not vulnerability scanning), AWS CloudTrail provides API logging, and AWS Support does not automate application-level vulnerability scanning.
Verifying that the other choices do not perform the requested vulnerability scanning tasks ensures the selection of the correct service.

Key Concept

Vulnerability scanning of container images and Lambda functions using Amazon Inspector
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic