Examkin

Question

Difficulty: Very hardThreat Detection and Vulnerability Management

A logistics provider runs a custom inventory application on a fleet of Amazon EC2 instances. The provider wants to implement automated checks to identify known software package vulnerabilities and unintended network exposure on these instances. According to the AWS Shared Responsibility Model, which statement correctly identifies the party responsible for configuring these checks, and the AWS service that should be utilized?

  1. The customer is responsible for securing their guest operating systems and applications, and they should use Amazon Inspector to perform the vulnerability scans.Answer
  2. B
    AWS is responsible for maintaining the security of the guest operating system on EC2 instances, and AWS automatically performs these scans using Amazon Inspector.
  3. C
    The customer is responsible for securing their guest operating systems and applications, and they should use Amazon GuardDuty to perform the vulnerability scans.
  4. D
    AWS is responsible for securing the customer's application dependencies, and AWS automatically monitors for vulnerabilities using AWS CloudTrail.

Answer

The customer is responsible for securing their guest operating systems and applications, and they should configure Amazon Inspector to perform software package vulnerability and network exposure scans.
The correct option correctly identifies that under the AWS Shared Responsibility Model, the customer is responsible for the guest operating system and applications running on Amazon EC2. It also correctly specifies Amazon Inspector as the designated AWS service for scanning EC2 instances for software vulnerabilities and unintended network path exposure.

Step-by-Step Solution

1
Determine the boundary of responsibility for Amazon EC2 instances under the AWS Shared Responsibility Model.
Since EC2 is an Infrastructure as a Service (IaaS) offering, the customer retains control over the guest operating system, application stack, and security configurations. Therefore, the customer, not AWS, is responsible for vulnerability scanning and patching of the OS and applications.
This step eliminates options that incorrectly shift the guest OS security and vulnerability scanning responsibility to AWS.
2
Identify the AWS service specifically designed for software package vulnerability scanning and network exposure checks on EC2 instances.
Amazon Inspector is the service that automates vulnerability management by scanning EC2 instances, Amazon ECR container images, and AWS Lambda functions for software vulnerabilities (CVEs) and unintended network path exposures.
This step distinguishes Amazon Inspector from other security services like Amazon GuardDuty (which does active threat detection) and AWS CloudTrail (which does API logging).

Key Concept

Vulnerability scanning on Amazon EC2 falls under the customer's side of the Shared Responsibility Model and is performed using Amazon Inspector.
Estimated Time:1m 30s
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic