A security team is comparing Amazon Inspector v2 with the original Inspector service. Which capability is newly available in v2 rather than carried over from the classic service?
Show answer and explanation
Answer: B
Inspector v2 drops the classic model of assessment targets and scheduled runs. It discovers supported resources itself and rescans them continuously as they change, and it extended coverage beyond EC2 hosts to Lambda functions and container images stored in Amazon ECR. Both generations report software vulnerabilities and unintended network exposure, but only v2 does so automatically across those additional resource types.
IAM policy analysis belongs to IAM Access Analyzer, and public-access evaluation of S3 buckets belongs to Access Analyzer for S3 and Macie, not Inspector.
Why the other options are wrong
- A. This describes classic Inspector, where you created assessment targets and scheduled runs for network reachability. v2 removes that manual targeting and scans continuously, so this is not the new capability.
- C. Right-sizing IAM policies from observed activity is the job of IAM Access Analyzer's unused-access findings, not Inspector, which reports vulnerabilities and network exposure rather than permissions.
- D. Bucket policy and ACL review is performed by IAM Access Analyzer for S3 and by Macie for sensitive-data discovery. Inspector does not evaluate S3 access controls.
Exam tip. Inspector v2 = automatic discovery plus continuous rescans, and it covers EC2, Lambda and ECR images.