SAP-C02 · Question #782
A company has several AWS Lambda functions written in Python. The functions are deployed with the .zip package deployment type. The functions use a Lambda layer that contains common libraries and…
The correct answer is A. Activate Amazon Inspector. Start automated CVE scans. B. Activate Lambda standard scanning and Lambda code scanning in Amazon Inspector. E. Tag Lambda functions that do not need code scans. In the tag, include a key of. The company needs to automatically scan all AWS Lambda functions and layers for CVEs, and also perform targeted code scans for data leaks and vulnerabilities on only a specific subset of Lambda functions.
Question
A company has several AWS Lambda functions written in Python. The functions are deployed with the .zip package deployment type. The functions use a Lambda layer that contains common libraries and packages in a .zip file. The Lambda .zip packages and Lambda layer .zip file are stored in an Amazon S3 bucket. The company must implement automatic scanning of the Lambda functions and the Lambda layer to identify CVEs. A subset of the Lambda functions must receive automated code scans to detect potential data leaks and other vulnerabilities. The code scans must occur only for selected Lambda functions, not all the Lambda functions. Which combination of actions will meet these requirements? (Choose three.)
Options
- AActivate Amazon Inspector. Start automated CVE scans.
- BActivate Lambda standard scanning and Lambda code scanning in Amazon Inspector.
- CEnable Amazon GuardDuty. Enable the Lambda Protection feature in GuardDuty.
- DEnable scanning in the Monitor settings of the Lambda functions that need code scans.
- ETag Lambda functions that do not need code scans. In the tag, include a key of
- FUse Amazon Inspector to scan the 3 bucket that contains the Lambda .zip packages and the
How the community answered
(40 responses)- A83% (33)
- C3% (1)
- D5% (2)
- F10% (4)
Why each option
The company needs to automatically scan all AWS Lambda functions and layers for CVEs, and also perform targeted code scans for data leaks and vulnerabilities on only a specific subset of Lambda functions.
Option A initiates Amazon Inspector, the core service for automated vulnerability management.
Option B explicitly activates Lambda standard scanning in Inspector for CVEs in dependencies across all functions and layers, and Lambda code scanning for identifying vulnerabilities like data leaks in custom code.
Amazon GuardDuty's Lambda Protection focuses on runtime threat detection, not static vulnerability scanning for CVEs or code-level data leaks.
There is no native 'scanning' setting within the Monitor section of individual Lambda functions for vulnerability or code scans; these are managed by services like Amazon Inspector.
Option E allows for fine-grained control over which Lambda functions receive the code scans by leveraging tags for inclusion or exclusion in the Inspector scanning scope, ensuring only the selected subset is scanned.
Amazon Inspector scans deployed Lambda functions and their layers, not the raw .zip packages stored in an S3 bucket.
Concept tested: Amazon Inspector for Lambda vulnerability scanning (CVEs, code analysis), scoping scans with tags
Source: https://aws.amazon.com/inspector/features/lambda-vulnerability-scanning/
Community Discussion
No community discussion yet for this question.