A company requires a specific software application to be installed on all new and existing Amazon EC2 instances across an AWS Organization. SSM Agent is installed and active. How can the company…

Question

Options

• AUse AWS Config organization-wide with the ec2-managedinstance-applications-required
• BUse approved AMIs rule organization-wide.
• CUse Distributor package and review output.
• DUse Systems Manager Application Manager inventory filtering.

• A
  81% (26)
• B
  6% (2)
• C
  3% (1)
• D
  9% (3)

Explanation

Continuous monitoring requires an always-on compliance service that evaluates resources over time. AWS Config provides managed rules that assess configuration state and compliance continuously. AWS Certified Security - Specialty guidance highlights AWS Config for continuous compliance across accounts and regions when used with AWS Organizations. The ec2- managedinstance-applications- required managed rule evaluates whether specified software is installed on managed instances, leveraging Systems Manager inventory/managed instance status. By enabling AWS Config organization-wide and deploying this managed rule across all accounts, the company can continuously evaluate both existing and newly launched instances for required application presence. This provides a consistent compliance dashboard and history of compliance changes. Option D can provide inventory lists, but it is not a compliance rule engine that flags noncompliance with the same governance reporting and remediation pathways. Options B and C are operational approaches but do not provide continuous compliance state across the

No community discussion yet for this question.