Q36 — AWS SAA-C03 Ch.16

Question 36 of 100 | ← Chapter 16

Q1236. A security audit reveals that Amazon EC2 instances are not being patched regularly. A solutions architect needs to provide a solution that will run regular security scans across a large fleet of EC2 instances. The solution should also patch the EC2 instances on a regular schedule and provide a report of each instance's patch status.Which solution will meet these requirements?

Correct Answer: D. Turn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule.

Explanation

To address the requirement of running regular security scans across a large fleet of EC2 instances, patching them on a regular schedule, and providing a report of each instance's patch status, let's analyze the options:Key Requirements:Regular Security Scans: The solution must scan EC2 instances for software vulnerabilities. Regular Patching: The solution must patch EC2 instances on a regular schedule. Patch Status Reporting: The solution must provide a report of each instance's patch status.Solution Analysis:Amazon Macie:Purpose: Amazon Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS. It is not designed for scanning EC2 instances for software vulnerabilities or patching them.Amazon GuardDuty:Purpose: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. It does not scan for software vulnerabilities or patch instances.Amazon Detective:Purpose: Amazon Detective helps you analyze, investigate, and quickly identify the root cause of security findings or suspicious activities. It is not designed for scanning EC2 instances for software vulnerabilities or patching them.Amazon Inspector:Purpose: Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It can scan EC2 instances for software vulnerabilities and provide detailed reports.AWS Systems Manager Patch Manager:Purpose: AWS Systems Manager Patch Manager automates the process of patching managed instances, including EC2 instances. It can be configured to patch instances on a regular schedule and provides patch compliance reports.AWS Systems Manager Session Manager:Purpose: AWS Systems Manager Session Manager provides secure and auditable instance management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. It is not used for patching instances.Amazon EventBridge:Purpose: Amazon EventBridge is a serverless event bus that makes it easy to connect applications together using data from your own applications, integrated Software-as-a-Service (SaaS) applications, and AWS services. While it can be used to trigger scheduled tasks, it is not a patching solution itself.Evaluating the Options:Option A: Set up Amazon Macie to scan the EC2 instances for software vulnerabilities. Set up a cron job on each EC2 instance to patch the instance on a regular schedule. Incorrect: Macie is not designed for scanning EC2 instances for software vulnerabilities. Additionally, setting up cron jobs on each instance is not scalable or manageable for a large fleet. Option B: Turn on Amazon GuardDuty in the account. Configure GuardDuty to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Session Manager to patch the EC2 instances on a regular schedule.Incorrect: GuardDuty does not scan for software vulnerabilities. Session Manager is not used for patching instances.Option C: Set up Amazon Detective to scan the EC2 instances for software vulnerabilities. Set up an Amazon EventBridge scheduled rule to patch the EC2 instances on a regular schedule. Incorrect: Detective is not designed for scanning EC2 instances for software vulnerabilities. EventBridge is not a patching solution.Option D: Turn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule.Correct: This option uses Amazon Inspector to scan EC2 instances for software vulnerabilities and AWS Systems Manager Patch Manager to patch instances on a regular schedule. It meets all the requirements and is scalable for a large fleet of EC2 instances.Final Answer:D. Turn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule.This solution provides regular security scans, automated patching, and patch status reporting for a large fleet of EC2 instances.