DOP-C02 Question 404
Select 3Your organization runs a large-scale microservices application on Amazon ECS. Security and compliance teams are concerned about potential vulnerabilities in containerized applications and unauthorized access to resources. As a DevOps Engineer, your task is to implement a solution that identifies container vulnerabilities, detects anomalous activity, and ensures IAM policies are not overly permissive. Which combination of AWS services should you use to address these concerns?
- A
Amazon Inspector
- B
AWS GuardDuty
- C
IAM Access Analyzer
- D
AWS Config
- E
Amazon Macie
Show answer and explanation
Correct answers: A, B, C
Explanation
To address the organization's concerns, Amazon Inspector can scan for container vulnerabilities, AWS GuardDuty can detect anomalous activity, and IAM Access Analyzer can ensure IAM policies are not overly permissive. While AWS Config and Amazon Macie are valuable services, they do not directly address the specific security requirements in this scenario.
- A. Correct.
Amazon Inspector is a security assessment service that can identify vulnerabilities in container images and other resources, making it highly relevant for containerized applications.
- B. Correct.
AWS GuardDuty is a threat detection service that monitors for malicious or unauthorized activity, helping identify anomalous behavior in your environment.
- C. Correct.
IAM Access Analyzer analyzes IAM policies to identify resources that are publicly accessible or overly permissive, addressing concerns about unauthorized access.
- D. Incorrect.
AWS Config is a configuration management service that tracks resource configurations but does not directly identify vulnerabilities or detect threats.
- E. Incorrect.
Amazon Macie is a data protection service focused on identifying sensitive data but is not relevant for container vulnerability scanning or IAM policy analysis.