DOP-C02 Question 405
Single answerYour organization runs a distributed web application in AWS. A recent security review revealed that some Amazon EC2 instances have outdated software with known vulnerabilities. As a DevOps Engineer, you are tasked with implementing an automated solution to identify these vulnerabilities and provide remediation recommendations. Which AWS service is best suited to meet this requirement?
- A
Amazon GuardDuty
- B
Amazon Inspector
- C
AWS Config
- D
IAM Access Analyzer
Show answer and explanation
Correct answer: B
Explanation
Amazon Inspector is the best service for this scenario because it automatically scans EC2 instances for security vulnerabilities, such as outdated software or configuration issues, and provides detailed findings with remediation recommendations. This makes it an ideal solution for identifying and addressing the security concerns highlighted in the organization's review.
- A. Incorrect.
Amazon GuardDuty is used for threat detection and monitoring of suspicious activities, such as unauthorized access or unusual API calls. It does not scan for software vulnerabilities on EC2 instances.
- B. Correct.
Amazon Inspector is the correct choice. It is specifically designed to automatically assess EC2 instances for vulnerabilities and deviations from security best practices and provide actionable remediation recommendations.
- C. Incorrect.
AWS Config tracks configuration changes and evaluates resource compliance based on rules, but it does not perform vulnerability assessments on EC2 instances.
- D. Incorrect.
IAM Access Analyzer identifies potential resource access risks by analyzing policies, but it does not assess the security posture of EC2 instances or detect software vulnerabilities.