A company uses Amazon EC2 Linux instances in the AWS Cloud. A member of the company's security team recently received a report about common vulnerability identifiers on the instances. A security…

Question

Options

• AUse AWS Systems Manager Patch Manager to view vulnerability identifiers for missing patches
• BUse AWS Shield Advanced to view vulnerability identifiers for missing patches on the instances.
• CUse Amazon GuardDuty to view vulnerability identifiers for missing patches on the instances. Use
• DUse Amazon inspector to view vulnerability identifiers for missing patches on the instances. Use

• A
  79% (42)
• B
  4% (2)
• C
  11% (6)
• D
  6% (3)

Explanation

AWS Systems Manager Patch Manager is the correct service because it is purpose-built to scan EC2 instances for missing patches, report on compliance against patch baselines (which maps directly to CVE/vulnerability identifiers), and automatically remediate by deploying missing patches on a schedule - exactly what the question requires end-to-end.

Why the distractors are wrong:

• B (AWS Shield Advanced) is a DDoS protection service; it has no knowledge of OS-level patches or vulnerability identifiers.
• C (Amazon GuardDuty) is a threat detection service that analyzes logs/network traffic for suspicious behavior - it does not scan for missing OS patches.
• D (Amazon Inspector) can surface CVE-based vulnerability findings on EC2 instances, but it is a detection-only tool - it cannot automatically apply patches. Patch Manager is still needed for remediation, making A the more complete, single-service answer.

Memory tip: Think "Patch Manager patches" - the name is literal. If a question asks about both identifying missing patches and automatically remediating them on EC2, Systems Manager Patch Manager is the only AWS service that covers both steps in one solution.

No community discussion yet for this question.