DOP-C02 Question 251
Select 3Your organization uses Amazon Inspector for vulnerability scanning across multiple AWS accounts in an organization. You are tasked with creating an assessment template to ensure that Amazon Inspector scans EC2 instances for both network reachability and Common Vulnerabilities and Exposures (CVE) findings. Additionally, the scans must be automated to run weekly. Which steps should you take to meet these requirements?
- A
Create an assessment target in Amazon Inspector, specifying the desired EC2 instances using a resource group.
- B
Create an assessment template and include both the 'Network Reachability' and 'CVE' rules packages.
- C
Manually initiate the scans weekly from the Amazon Inspector console.
- D
Set up an Amazon EventBridge rule to schedule the assessment template to run weekly.
- E
Use Amazon Inspector to automatically generate a resource group based on all EC2 instances in the account.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, you need to define the target EC2 instances using a resource group, create an assessment template with the appropriate rules packages (Network Reachability and CVE), and schedule the scans to run weekly using Amazon EventBridge. Manual initiation or reliance on auto-generated resource groups does not fulfill the automation and specificity requirements outlined in the scenario.
- A. Correct.
Correct: An assessment target is necessary in Amazon Inspector to specify the scope of the resources to be scanned, such as EC2 instances. A resource group is used to define these resources.
- B. Correct.
Correct: Creating an assessment template and selecting the appropriate rules packages (e.g., 'Network Reachability' and 'CVE') ensures that the scans cover the required vulnerabilities and reachability checks.
- C. Incorrect.
Incorrect: Reliance on manual initiation contradicts the requirement for automation. Scans must be automated to run weekly.
- D. Correct.
Correct: Amazon EventBridge can be used to schedule the assessment template to run at a specified interval, such as weekly, fulfilling the requirement for automation.
- E. Incorrect.
Incorrect: While Amazon Inspector can automatically generate a resource group, this is not a required step. Resource groups can also be manually defined, and the question does not state that auto-generation is necessary.