SCS-C02 Question 485
Select 3An organization has several AWS accounts consolidated under AWS Organizations. During a recent security review, the Security team identified that some EC2 instances across accounts are using unapproved AMIs and others are underutilized but still running, incurring unnecessary costs. As part of the architectural review, what actions should the Security team take to address these gaps?
- A
Implement AWS Config rules to ensure EC2 instances are launched only with approved AMIs.
- B
Utilize AWS Trusted Advisor to identify underutilized EC2 instances and generate reports for cost optimization.
- C
Enable AWS CloudTrail in all accounts to track API activities for EC2 instances.
- D
Establish Service Control Policies (SCPs) in AWS Organizations to prevent the launch of EC2 instances with unapproved AMIs.
- E
Use Amazon GuardDuty to identify instances that are running unapproved AMIs.
Show answer and explanation
Correct answers: A, B, D
Explanation
To address the identified security and cost gaps, the Security team should implement AWS Config rules to enforce compliance with approved AMIs, utilize AWS Trusted Advisor to identify underutilized EC2 instances for cost optimization, and establish SCPs to prevent the launch of non-compliant instances. These actions directly address the gaps while ensuring the organization's security and cost objectives are met.
- A. Correct.
Implementing AWS Config rules allows the organization to enforce compliance by detecting EC2 instances launched with unapproved AMIs. This addresses the security gap effectively.
- B. Correct.
AWS Trusted Advisor helps identify underutilized EC2 instances, allowing the organization to optimize costs. This directly addresses the cost-related gap.
- C. Incorrect.
Enabling AWS CloudTrail provides visibility into API activities but does not directly solve the issue of unapproved AMIs or underutilized instances. It is useful for auditing but not specific to this scenario.
- D. Correct.
Service Control Policies (SCPs) in AWS Organizations can restrict actions at the account level, such as launching EC2 instances with unapproved AMIs. This is an effective way to prevent non-compliant behavior.
- E. Incorrect.
Amazon GuardDuty is a threat detection service but does not identify or enforce the use of approved AMIs. It is not relevant to addressing this specific security or cost issue.