Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A retail company hosts its core inventory management system on a fleet of Amazon EC2 instances. The company's security policy requires automated, continuous assessments of these instances to identify software package vulnerabilities and unintended network paths that could lead to exposure. Which AWS service should the company use to automate these security assessments?

  1. A
    Amazon GuardDuty
  2. Amazon InspectorAnswer
  3. C
    AWS CloudTrail
  4. D
    AWS Shared Infrastructure Support, as vulnerability scanning and patching of customer-configured EC2 operating systems is the sole responsibility of AWS

Answer

Amazon Inspector
Amazon Inspector is the correct service because it provides automated, continuous vulnerability management. It scans Amazon EC2 instances, Amazon Elastic Container Registry (ECR) container images, and AWS Lambda functions for software vulnerabilities and unintended network exposure.

Step-by-Step Solution

1
Identify the security requirement.
The company needs to continuously scan EC2 instances for software vulnerabilities and network path exposure.
This establishes the target service capability needed (host and vulnerability assessment).
2
Match the requirement with the correct AWS service capability.
Amazon Inspector is designed specifically for automated and continuous vulnerability scanning of EC2 instances, container images, and Lambda functions.
This distinguishes it from log-monitoring, API-logging, or shared infrastructure services.

Key Concept

Automated host and container vulnerability scanning using Amazon Inspector
Estimated Time:1m 30s
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic