A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using…

Question

Options

• AConfigure logging on the Amazon CloudWatch agent for IMDSv1 as part of EC2 instance startup.
• BCreate an Amazon CloudWatch dashboard Verify that the EC2MetadataNoToken metric is zero
• CCreate a security group that blocks access to HTTP for the IMDSv1 endpoint Attach the security
• DConfigure user data scripts for all EC2 instances to send logging information to AWS CloudTrail

• A
  15% (5)
• B
  76% (25)
• C
  3% (1)
• D
  6% (2)

Explanation

Option B is correct because AWS publishes a CloudWatch metric called EC2MetadataNoToken that increments whenever an instance accesses the metadata service without an IMDSv2 session token - meaning it's using the older IMDSv1 path. A value of zero confirms no instances are falling back to IMDSv1, making this the purpose-built, native monitoring solution for exactly this migration scenario.

Why the distractors are wrong:

• A is wrong because the CloudWatch agent collects OS-level metrics and logs; it has no built-in awareness of IMDS version usage and would require custom, non-trivial instrumentation.
• C is wrong because blocking HTTP to the metadata endpoint (169.254.169.254) would break IMDSv1 rather than detect it - it's a remediation step, not a monitoring step, and it could disrupt running applications.
• D is wrong because CloudTrail logs AWS API calls (control plane), not metadata service requests made from within an EC2 instance (data plane); IMDSv1 calls never appear in CloudTrail.

Memory tip: Think of EC2MetadataNoToken as a "no token = no IMDSv2" counter - if any instance skips the token-based handshake that IMDSv2 requires, this metric goes up. Zero means everyone's playing by the new rules.

No community discussion yet for this question.