DOP-C02 Question 254
Select 3Your organization is using Amazon Inspector to assess vulnerabilities in an Amazon EC2 environment. The DevOps team wants to ensure compliance with common security standards like CIS Benchmarks and identify potential software vulnerabilities. Which features of Amazon Inspector and associated actions should you leverage to achieve this goal?
- A
Enable Inspector scans using the Common Vulnerabilities and Exposures (CVE) template.
- B
Configure Inspector to automatically generate findings and integrate with AWS Security Hub.
- C
Use a custom-built assessment template to assess compliance with CIS Benchmarks.
- D
Enable network reachability assessments to identify open ports and exposed services.
- E
Schedule recurring assessments using built-in assessment templates for compliance and vulnerabilities.
Show answer and explanation
Correct answers: A, B, E
Explanation
To ensure compliance with CIS Benchmarks and identify software vulnerabilities, Amazon Inspector provides built-in assessment templates like the CVE and CIS Benchmarks templates. These templates simplify the process of vulnerability and compliance assessments. Additionally, integrating Inspector findings with AWS Security Hub enables centralized security management. Scheduling recurring scans using the built-in templates ensures continuous monitoring and remediation of vulnerabilities.
- A. Correct.
Correct: The CVE template in Amazon Inspector is specifically designed to identify vulnerabilities in software packages and libraries, aligning with the goal of identifying software vulnerabilities.
- B. Correct.
Correct: Amazon Inspector findings can be integrated with AWS Security Hub to centralize security findings and streamline compliance monitoring.
- C. Incorrect.
Incorrect: While custom-built templates might seem useful, Amazon Inspector already provides built-in templates (e.g., CIS Benchmarks) for compliance. Custom templates are not required in this scenario.
- D. Incorrect.
Incorrect: Network reachability assessments are useful for analyzing network configurations but are not directly related to assessing compliance with CIS Benchmarks or identifying software vulnerabilities.
- E. Correct.
Correct: Amazon Inspector's built-in templates for compliance (e.g., CIS Benchmarks) and vulnerability assessments support scheduling recurring scans, ensuring continuous security monitoring.