DOP-C02 Question 403
Select 3Your company has deployed a large-scale microservices application on AWS. Recently, the security team raised concerns about potential vulnerabilities in the application due to outdated software components and excessive IAM permissions granted to certain roles. You have been tasked with identifying these vulnerabilities and ensuring compliance with security best practices. Which combination of AWS services should you use to address these concerns effectively?
- A
Amazon Inspector to scan for vulnerabilities in the application's software components
- B
AWS IAM Access Analyzer to identify overly permissive IAM policies and roles
- C
AWS Config to ensure that the application complies with security-related configuration rules
- D
Amazon Macie to analyze and discover sensitive data stored in the application
- E
AWS Trusted Advisor to monitor cost optimization and performance issues
Show answer and explanation
Correct answers: A, B, C
Explanation
The combination of Amazon Inspector, AWS IAM Access Analyzer, and AWS Config effectively addresses the security team's concerns. Amazon Inspector scans for application vulnerabilities, AWS IAM Access Analyzer identifies overly permissive IAM policies, and AWS Config ensures compliance with security-related configuration rules. Together, these services provide a comprehensive approach to securing the application.
- A. Correct.
Amazon Inspector is designed to identify vulnerabilities in application software components, such as outdated libraries or misconfigurations. This directly addresses concerns about software vulnerabilities.
- B. Correct.
AWS IAM Access Analyzer helps identify overly permissive IAM policies and roles, which is essential for addressing concerns about excessive permissions.
- C. Correct.
AWS Config can be used to enforce compliance with security-related configuration rules, ensuring that the application adheres to best practices.
- D. Incorrect.
Amazon Macie focuses on discovering sensitive data within storage solutions like S3, but it does not address software vulnerabilities or IAM permissions.
- E. Incorrect.
AWS Trusted Advisor provides general recommendations for cost, performance, and security but is not specialized for identifying software vulnerabilities or IAM-related issues.