AWS Certified Security – SpecialtyDomain 2: Logging and MonitoringEasy
A company is required to regularly analyze their AWS environment for potential security vulnerabilities and deviations from security best practices, such as insecure configurations, exposed secrets, or misconfigured permissions. The analysis needs to be automated and provide actionable findings that can be integrated into a security workflow. Which AWS service is designed to perform these automated security assessments?
- AAmazon Inspector
- BAWS CloudHSM
- CAWS Systems Manager Patch Manager
- DAWS Certificate Manager (ACM)
Show answer & explanationAnswer & explanation
Correct answer: A. Amazon Inspector
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It automatically discovers and scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure, providing actionable findings.
Why the other options are wrong
- B. AWS CloudHSM provides hardware security modules (HSMs) in the AWS Cloud, primarily for cryptographic operations, not for automated security assessments of the environment.
- C. Systems Manager Patch Manager automates the process of patching managed instances, not for vulnerability assessment or best practice deviation detection.
- D. AWS Certificate Manager (ACM) provisions, manages, and deploys SSL/TLS certificates, it is not a security assessment service.
Amazon Inspector
An automated security assessment service that helps improve the security and compliance of applications deployed on AWS by identifying vulnerabilities and deviations from best practices.
- Discovers and scans EC2 instances, container images, and Lambda functions.
- Identifies software vulnerabilities and unintended network exposure.
- Generates prioritized, actionable security findings.
- Integrates with AWS Security Hub for centralized management of findings.
Memory trick: Inspector scans, finds flaws, keeps your AWS secure by its aws.