Which AWS service automatically scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure?
Show answer and explanation
Answer: D
Amazon Inspector continuously scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities and network exposure, and it reports findings with severity. GuardDuty analyzes events to detect threats such as suspicious API use or compromised instances, Config records configuration history, and CloudTrail records API activity. None of the other three perform vulnerability assessment of workloads.
Why the other options are wrong
- A. GuardDuty watches logs and network events for signs of an active threat. It does not scan installed software packages for known vulnerabilities.
- B. AWS Config records resource configurations and evaluates them against rules. It does not check the software inside an instance for CVEs.
- C. CloudTrail records API calls for auditing. It shows who did what, not whether an instance has a vulnerable package.