SOA-C02 Question 224
Single answerYour organization uses multiple AWS services, and you have enabled AWS Security Hub, Amazon GuardDuty, AWS Config, and Amazon Inspector to monitor the security and compliance of your environment. During a routine audit, you are tasked with identifying potential EC2 instances that are vulnerable to known Common Vulnerabilities and Exposures (CVEs). Which service or tool should you prioritize to get this specific information quickly?
- A
AWS Security Hub
- B
Amazon GuardDuty
- C
AWS Config
- D
Amazon Inspector
Show answer and explanation
Correct answer: D
Explanation
Amazon Inspector is the appropriate tool for identifying EC2 instances vulnerable to known Common Vulnerabilities and Exposures (CVEs). It provides automated vulnerability management by scanning instances for critical security issues and delivering actionable findings. While other services like AWS Security Hub and GuardDuty are useful for broader security monitoring and threat detection, they do not provide direct insights into CVEs or instance-specific vulnerabilities.
- A. Incorrect.
AWS Security Hub aggregates security findings from various AWS services, but it does not perform vulnerability assessments directly. It simply provides a centralized dashboard for findings.
- B. Incorrect.
Amazon GuardDuty is designed for threat detection and anomaly detection, focusing on identifying suspicious activities like unauthorized access or data exfiltration. It does not perform vulnerability assessments on EC2 instances.
- C. Incorrect.
AWS Config provides configuration compliance checks and resource history tracking but does not provide information about instance vulnerabilities like CVEs.
- D. Correct.
Amazon Inspector is specifically designed to scan EC2 instances and container images for vulnerabilities, including CVEs, and provides detailed findings about which instances are at risk.