A company creates AWS Lambda functions from container images that are stored in Amazon Elastic Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the…

Question

Options

• AEnable Amazon GuardDuty. Configure Amazon ECR scanning and Lambda code scanning in
• BEnable Amazon GuardDuty. Configure Runtime Monitoring and Lambda Protection in GuardDuty.
• CEnable Amazon Inspector. Configure Amazon ECR enhanced scanning and Lambda code
• DEnable AWS Security Hub. Configure Runtime Monitoring and Lambda Protection in Security

• A
  3% (2)
• B
  7% (4)
• C
  72% (42)
• D
  17% (10)

Explanation

Explanation

Amazon Inspector is the purpose-built AWS service for vulnerability management, specifically designed to scan both container images in ECR (using enhanced scanning, which leverages Snyk for deeper analysis) and Lambda function code for software vulnerabilities - making option C the precise fit for this use case.

Why the distractors are wrong:

• Option A is incorrect because while GuardDuty does integrate with ECR and Lambda, it focuses on threat detection (suspicious activity, malicious behavior) rather than identifying software/code vulnerabilities in static images or code.
• Option B is incorrect for the same reason - GuardDuty's Runtime Monitoring watches for active threats at runtime, not static vulnerability scanning of container images or code.
• Option D is incorrect because AWS Security Hub is a security posture aggregation and dashboard tool; it consolidates findings from other services but does not perform vulnerability scanning itself.

Memory Tip: Think "Inspector = Inspect for vulnerabilities" - just like a building inspector looks for structural flaws before problems occur, Amazon Inspector proactively scans for vulnerabilities in code and containers. GuardDuty = "Guard" against active threats (runtime), while Inspector = find weaknesses in what you've built.

No community discussion yet for this question.