312-40 practice question 9 of 25

Richard Roxburgh works as a cloud security engineer in an IT company. His organization was dissatisfied with the services of its previous cloud…

Richard Roxburgh works as a cloud security engineer in an IT company. His organization was dissatisfied with the services of its previous cloud service provider. Therefore, in January 2020, his organization adopted AWS cloud-based services and shifted all workloads and data in the AWS cloud. Richard wants to provide complete security to the hosted applications before deployment and while running in the AWS ecosystem. Which of the following automated security assessment services provided by AWS can be used by Richard to improve application security and check the application for any type of vulnerability or deviation from the best practices automatically?

Answer options

A: AWS CloudFormation

B: Amazon Inspector Correct answer

C: AWS Control Tower

D: Amazon CloudFront

Correct Answer:

B. Amazon Inspector

Explanation

Amazon Inspector is an automated vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It is designed to automate security assessments and improve the security and compliance of applications deployed on AWS. It discovers running EC2 instances, container images in ECR, and Lambda functions, then assesses them against known vulnerabilities (CVEs) and best practices. This directly aligns with Richard's need to check applications for vulnerabilities and deviations from best practices automatically, both before deployment (for container images) and while running.

Why Incorrect

A. AWS CloudFormation is an Infrastructure as Code (IaC) service used for provisioning and managing AWS resources, not for performing security assessments on applications.
C. AWS Control Tower is a service for setting up and governing a secure, multi-account AWS environment. It focuses on governance and compliance, not application vulnerability scanning.
D. Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs. It is not an automated security assessment tool.

References

1. Amazon Web Services. (n.d.). What is Amazon Inspector? AWS Documentation. Retrieved from https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html. (See the "What is Amazon Inspector?" section, which states it is an "automated vulnerability management service").

2. Amazon Web Services. (n.d.). Amazon Inspector Features. AWS. Retrieved from https://aws.amazon.com/inspector/features/. (This page details how Inspector provides "Automated and continual vulnerability management").

3. Amazon Web Services. (2022). AWS Security Fundamentals (Second Edition). Official AWS Courseware. (Module 4: Security on AWS, describes Amazon Inspector as the primary service for automated security assessments of EC2 instances and container images).

Keep practicing

Take the free 312-40 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test