SCS-C02 Question 250
Select 2Your organization leverages Amazon EC2 instances and Amazon Elastic Container Registry (Amazon ECR) to run and store containerized applications. As part of a security compliance initiative, you need to ensure that vulnerabilities in both EC2 instances and container images stored in Amazon ECR are detected and addressed. Which AWS services or features can you use to achieve this goal?
- A
Amazon Inspector for EC2 and Amazon ECR
- B
AWS Config to monitor compliance of Amazon ECR images
- C
Amazon Detective for vulnerability scanning of EC2 instances
- D
Amazon GuardDuty to scan and remediate vulnerabilities in EC2 instances
- E
Amazon Inspector for Amazon ECR image scanning
Show answer and explanation
Correct answers: A, E
Explanation
Amazon Inspector is the appropriate service for scanning both EC2 instances and container images in Amazon ECR for vulnerabilities. AWS Config, Amazon Detective, and Amazon GuardDuty serve different purposes and do not provide workload vulnerability scanning capabilities. By leveraging Amazon Inspector, you can ensure your compute workloads are assessed for security risks and meet your compliance requirements.
- A. Correct.
Correct. Amazon Inspector is designed to scan EC2 instances for vulnerabilities, as well as container images stored in Amazon ECR.
- B. Incorrect.
Incorrect. AWS Config is used for compliance monitoring but is not a vulnerability scanning service.
- C. Incorrect.
Incorrect. Amazon Detective is focused on threat investigation and relationships between resources, not vulnerability scanning.
- D. Incorrect.
Incorrect. Amazon GuardDuty is a threat detection service that identifies malicious or unauthorized activities, but it does not scan for vulnerabilities in workloads.
- E. Correct.
Correct. Amazon Inspector includes the capability to scan container images in Amazon ECR for software vulnerabilities.