DOP-C02 Question 406
Select 3An organization has recently deployed a set of EC2 instances in their VPC to host a web application. They want to identify potential security vulnerabilities in these instances, ensure compliance with security best practices, and detect any unusual or unauthorized activity in the environment. Which combination of AWS services can meet these requirements?
- A
Amazon Inspector
- B
AWS GuardDuty
- C
IAM Access Analyzer
- D
AWS Config
- E
AWS Trusted Advisor
Show answer and explanation
Correct answers: A, B, D
Explanation
To address the organization's requirements, Amazon Inspector is used to identify vulnerabilities on the EC2 instances, AWS GuardDuty detects unusual or unauthorized activity in the environment, and AWS Config ensures compliance with security best practices by monitoring configuration changes. These services work together to provide a comprehensive security posture for the environment.
- A. Correct.
Amazon Inspector performs automated security assessments of applications deployed on EC2 instances, identifying vulnerabilities and deviations from security best practices. It helps ensure that the instances are secure.
- B. Correct.
AWS GuardDuty provides threat detection by monitoring logs and identifying unusual or unauthorized activity within the AWS environment. It helps alert the organization of potential threats.
- C. Incorrect.
IAM Access Analyzer focuses on analyzing IAM policies to identify resources that are shared externally. While useful, it does not directly address the detection of vulnerabilities or unusual activity in EC2 instances.
- D. Correct.
AWS Config tracks configuration changes and compliance against security and operational best practices. It helps ensure the environment remains compliant and secure over time.
- E. Incorrect.
AWS Trusted Advisor provides general best practice recommendations, but it is not tailored specifically for identifying vulnerabilities or threats in EC2 instances and the surrounding environment.