Inspector

Question 1

Which AWS automated vulnerability management service continuously scans workloads for software vulnerabilities and unintended network exposure?

Answer 1

Amazon Inspector

This deck covers Amazon Inspector Classic

Question 2

Which AWS services does Amazon Inspector assess for vulnerabilities and deviations from security best practices?

Answer 2

• Amazon EC2
• Amazon ECR
• AWS Lambda

Question 3

How frequently can Amazon Inspector run vulnerability scans?

Answer 3

Scans can run as often as:
- 15 minutes
- 1 hour
- 1 day

Question 4

What does Amazon Inspector produce after a scan completes?

Answer 4

A prioritized findings report, ordered by severity

Question 5

What two assessment types does Amazon Inspector provide?

Answer 5

• Network assessment: agent or agentless
• Host assessment: requires an agent

Question 6

Which Amazon Inspector assessment type analyzes network configurations for unintentional exposure to the internet?

Answer 6

Network assessment

Question 7

Which Amazon Inspector assessment type analyzes EC2 instances and container images for software vulnerabilities and configuration issues?

Answer 7

Host assessments

Question 8

What collection of security rules does Amazon Inspector use to assess a security posture?

Answer 8

Rules packages

Question 9

Which Amazon Inspector rules package analyzes end-to-end network reachability across EC2, ALB, Direct Connect, ELB, ENIs, Internet Gateway, NACLs, route tables, security groups, subnets, VPCs, VGWs, and VPC peering?

Answer 9

Network Reachability Rules Package

Question 10

What findings can the Network Reachability Rules Package return?

Answer 10

• RecognizedPortWithListener
• RecognizedPortNoListener
• RecognizedPortNoAgent
• UnrecognizedPortWithListener

Question 11

Which Amazon Inspector rules packages require an agent?

Answer 11

Host rules packages:
- Common Vulnerabilities and Exposures (CVE)
- Center for Internet Security (CIS) Benchmark
- Security Best Practices for Amazon Inspector

Question 12

What types of container image scanning does Amazon Inspector support?

Answer 12

• Enhanced scanning
• Basic scanning

Question 13

What does Amazon Inspector Enhanced Scanning provide?

Answer 13

Continuous scanning of container images for OS and programming language vulnerabilities, and event generation when new vulnerabilities are detected

Question 14

How does Amazon Inspector Basic Scanning work?

Answer 14

Performs scans on image push or manual trigger using the Common Vulnerabilities and Exposures (CVE) database from the open-source Clair project

Question 15

What types of vulnerabilities are detected by Amazon Inspector Enhanced Scanning?

Answer 15

Operating system and programming language package vulnerabilities