DOP-C02 Question 253
Select 2Your company has a multi-account AWS environment managed through AWS Organizations. You are tasked with ensuring that all EC2 instances across all accounts are continuously assessed for vulnerabilities and deviations from security best practices. Using Amazon Inspector, what steps should you take to achieve this goal?
- A
Enable Amazon Inspector across all accounts by configuring a delegated administrator in AWS Organizations.
- B
Manually create Amazon Inspector assessment templates in each account to scan EC2 instances for vulnerabilities.
- C
Ensure that EC2 instances have the Systems Manager Agent (SSM Agent) installed and are tagged appropriately for Amazon Inspector scans.
- D
Activate Amazon Inspector automatically across multiple accounts using AWS Organizations integration.
- E
Configure an Amazon Inspector assessment template to scan for network reachability vulnerabilities only.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure continuous vulnerability assessments across all accounts, you should integrate Amazon Inspector with AWS Organizations. This allows you to centrally manage and enable automatic scanning of EC2 instances for vulnerabilities. Amazon Inspector does not require manual assessment template creation, specific tagging, or the installation of the SSM Agent. Instead, it simplifies operations by automating the process through AWS Organizations.
- A. Correct.
Correct: Enabling Amazon Inspector across accounts with a delegated administrator in AWS Organizations ensures centralized management and consistent coverage for all accounts.
- B. Incorrect.
Incorrect: Manually creating assessment templates in each account is unnecessary when using Amazon Inspector's automated multi-account integration with AWS Organizations.
- C. Incorrect.
Incorrect: While the SSM Agent is required for certain AWS services, Amazon Inspector does not require EC2 instances to have the SSM Agent installed or specific tags for vulnerability scanning.
- D. Correct.
Correct: Enabling Amazon Inspector across multiple accounts via AWS Organizations integration automates assessments and simplifies its deployment in a multi-account environment.
- E. Incorrect.
Incorrect: Configuring a template for network reachability alone does not ensure comprehensive vulnerability monitoring across all EC2 instances. Amazon Inspector automatically scans for known vulnerabilities without requiring manual assessment templates.