DOP-C02 Question 252
Select 2Your organization uses Amazon Inspector to assess vulnerabilities across multiple Amazon EC2 instances and container workloads. You are tasked with automating regular security assessments while ensuring compliance with organizational policies. Which of the following actions should you take to achieve this goal?
- A
Create an Amazon Inspector assessment template with a pre-defined rules package and schedule recurring runs.
- B
Enable Amazon Inspector in your AWS account, as it automatically assesses all resources without requiring additional configuration.
- C
Use AWS Systems Manager to deploy Amazon Inspector agents to all EC2 instances within your environment.
- D
Configure an assessment template to include custom rules tailored to your organization's security and compliance requirements.
- E
Manually initiate Amazon Inspector assessments each time to maintain control over their execution.
Show answer and explanation
Correct answers: A, D
Explanation
To automate and maintain regular security assessments using Amazon Inspector, you should configure an assessment template with recurring schedules and include custom rules if needed to meet compliance requirements. This ensures continuous monitoring and alignment with your organization's security policies, making options 1 and 4 the correct choices.
- A. Correct.
Correct. By creating an Amazon Inspector assessment template using a pre-defined rules package, you can automate recurring security assessments, ensuring vulnerabilities are regularly identified based on standardized rules.
- B. Incorrect.
Incorrect. While enabling Amazon Inspector is required, it does not automatically assess all resources. You must configure assessment targets and templates for scans to occur.
- C. Incorrect.
Incorrect. Amazon Inspector does not require agent installation on EC2 instances unless you're using older versions of Inspector (pre-2021). For modern Inspector, agent-based installation is unnecessary as it integrates with AWS services like Systems Manager Inventory.
- D. Correct.
Correct. Customizing an assessment template ensures the security checks align with your organization's specific compliance and security requirements, making the assessments more relevant and effective.
- E. Incorrect.
Incorrect. Manually initiating assessments is less efficient and does not support automation, which is a key component of DevOps best practices and maintaining consistent security posture.