SCS-C02 · Question #45
A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using In
The correct answer is B. Create an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata- MDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this me
Question
A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using Instance Metadata Service Version 1 (IMDSv1). What should the security engineer do to confirm that the IMDSv1 endpoint is no longer being used?
Options
- AConfigure logging on the Amazon CloudWatch agent for IMDSv1 as part of EC2 instance startup.
- BCreate an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero
- CCreate a security group that blocks access to HTTP for the IMDSv1 endpoint. Attach the security
- DConfigure user data scripts for all EC2 instances to send logging information to AWS CloudTrail
How the community answered
(36 responses)- A3% (1)
- B81% (29)
- C6% (2)
- D11% (4)
Explanation
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata- MDSv2 uses token-backed sessions, while IMDSv1 does not. The MetadataNoToken CloudWatch metric tracks the number of calls to the instance metadata service that are using IMDSv1. By tracking this metric to zero, you can determine if and when all of your software has been upgraded to use IMDSv2.
Topics
Community Discussion
No community discussion yet for this question.