A company has a list of pre-approved Amazon Machine Images (AMIs) for developers to use to launch Amazon EC2 instances. However, developers are still launching EC2 instances from unapproved AMIs. A…

Question

Options

• ASet up an AWS Config managed rule to check if instances are running from AMIs that are on the
• BStore the list of pre-approved AMIs in an Amazon DynamoDB global table that is replicated to all
• CSelect the Amazon CloudWatch metric that shows all running instances and the AMIs that the
• DCreate a custom Amazon Inspector finding to compare a running instance's AMI against the list of

• A
  77% (40)
• B
  13% (7)
• C
  6% (3)
• D
  4% (2)

Explanation

Option A is correct because AWS Config's managed rule approved-amis-by-id (or a custom Config rule) continuously evaluates running EC2 instances against your approved AMI list, and - critically - you can attach an automatic remediation action (via AWS Systems Manager Automation) to terminate any non-compliant instance the moment it's detected, making this a fully automated enforcement solution.

Option B is wrong because storing AMIs in DynamoDB is just a data store - DynamoDB has no mechanism to evaluate running instances or trigger termination; it would require additional custom logic to do anything with that data.

Option C is wrong because CloudWatch metrics are for monitoring and alerting, not enforcement; even if you create an alarm on a custom metric, CloudWatch itself cannot terminate instances without wiring up additional services like Lambda, which would require building a custom solution rather than using a managed one.

Option D is wrong because Amazon Inspector is a vulnerability and security assessment service - it scans for CVEs and misconfigurations, not for AMI policy compliance, and it has no built-in capability to auto-terminate instances.

Memory tip: Think "Config = Compliance + Remediation." Whenever an exam question asks about automatically enforcing a resource configuration policy (AMIs, tags, encryption settings), AWS Config with automated remediation is almost always the answer - it's purpose-built for the detect-and-correct pattern.

No community discussion yet for this question.