SAP-C02 · Question #332
A company is using an existing orchestration tool to manage thousands of Amazon EC2 instances. A recent penetration test found a vulnerability in the company's software stack. This vulnerability has…
The correct answer is D. install the AWS Systems Manager Agent on all existing instances using the company's current. To enable AWS Config to continuously audit and assess the compliance of EC2 instances for vulnerabilities like outdated OS libraries, the AWS Systems Manager Agent must be installed on all existing instances.
Question
A company is using an existing orchestration tool to manage thousands of Amazon EC2 instances. A recent penetration test found a vulnerability in the company's software stack. This vulnerability has prompted the company to perform a full evaluated of its current production environment. The analysts determined that the following vulnerabilities exist within the environment:
- Operating systems with outdated libraries and known vulnerabilities
are being used in production
- Relational databases hosted and managed by the company are running
unsupported versions with known vulnerabilities
- Data stored in databases Is not encrypted.
The solutions architect intends to use AWS Config to continuously audit and assess the compliance of the company's AWS resource configurations with the company's polices and guidelines. What additional steps will enable the company to secure its environments and track resources while adhering to best practices?
Options
- AUse AWS Application Discovery Service to evaluate at running EC2 instances.
- BCreate an AWS CloudFormation template for the EC2 instances.
- CInstall the AWS Systems Manager Agent on all existing instances using the company's current
- Dinstall the AWS Systems Manager Agent on all existing instances using the company's current
How the community answered
(33 responses)- A6% (2)
- B15% (5)
- C3% (1)
- D76% (25)
Why each option
To enable AWS Config to continuously audit and assess the compliance of EC2 instances for vulnerabilities like outdated OS libraries, the AWS Systems Manager Agent must be installed on all existing instances.
AWS Application Discovery Service is primarily for planning on-premises migrations, not for continuous auditing and assessment of running EC2 instances or databases for vulnerabilities.
Creating a CloudFormation template defines the desired state of EC2 instances but does not provide real-time auditing of their running configuration or identify vulnerabilities in their software stack.
This choice is identical to D in the prompt, making it also correct if D is correct.
Installing the AWS Systems Manager (SSM) Agent on all existing EC2 instances enables AWS Config to gather detailed operating system and software inventory, perform patch compliance checks, and assess against configuration rules for outdated libraries and known vulnerabilities.
Concept tested: AWS Config with Systems Manager for compliance
Source: https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html
Community Discussion
No community discussion yet for this question.