A company's developers manually install software modules on Amazon EC2 instances to deploy new versions of a service. A security audit finds that instances contain inconsistent and unapproved modules.

Question

Options

• AUse Amazon Detective to continuously find and uninstall unauthorized modules from the
• BUse Amazon GuardDuty to create and deploy an Amazon Machine Image (AMI) that includes
• CUse AWS Systems Manager Run Command to install the approved modules on all running
• DUse EC2 Image Builder to create and test an Amazon Machine Image (AMI) that includes only

• A
  3% (1)
• B
  15% (5)
• C
  6% (2)
• D
  76% (25)

Explanation

According to the AWS Cloud Operations and Deployment documentation, EC2 Image Builder is the AWS-managed service for automating the creation, maintenance, validation, and deployment of secure and compliant Amazon Machine Images (AMIs). It allows CloudOps teams to define image pipelines that include only approved software modules and configuration scripts. EC2 Image Builder automatically tests and verifies these AMIs for compliance before deployment. This process ensures configuration consistency, eliminates manual installation errors, and simplifies ongoing patch management. The service integrates with AWS Systems Manager, Amazon Inspector, and AWS CloudFormation for end-to-end automation. Amazon Detective and GuardDuty (Options A & B) are security monitoring tools, not image management solutions. Run Command (Option C) applies ad-hoc updates but does not create standard, reusable AMIs. Therefore, Option D is correct--EC2 Image Builder provides the most operationally efficient and compliant way to create an approved baseline AMI for future deployments.

No community discussion yet for this question.