SCS-C03 practice question: Hardened AMIs and container images (EC2 Image Builder)

Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A university IT department builds the server images for its teaching and research systems. Each image must be hardened to the CIS benchmark, tested before it is released, and shared only with the university's own AWS accounts. The department has about 40 accounts in one AWS Organizations organization.

The image must be rebuilt every week without anyone running a manual step, and no image may be public. The security team also wants the hardening steps written as code that reviewers can read.

Which TWO actions should the department take to meet these requirements? (Choose two.)

Choose two answers.

A. Launch an instance each week, run the CIS hardening script by hand, test it by hand, and then create the image from the console.
B. Create an EC2 Image Builder recipe that starts from the approved base image and applies a hardening component written for the CIS benchmark, then add a test component that checks the hardening.
C. Set the AMI to public so that every department can launch it without asking the platform team, and rely on the image owner to keep it hardened.
D. Harden the servers with user data scripts at launch time, so that every instance is configured on first boot and no image needs to be tested.
E. Set the pipeline distribution settings to share each new image with the organization ARN only, and set the pipeline schedule to run once a week.

Show the answer and explanation

Answers: B, E

A. Wrong: This works once, but it is a manual step every week, which the requirement rules out. Manual runs also make the hardening hard to reproduce or review.
B. Right: Correct. Image Builder components are written as code and run in order, so the hardening and the tests happen during the build. A failed test stops the pipeline, so an unhardened image is never released. Learn more: What is EC2 Image Builder? (opens in a new tab)
C. Wrong: A public image breaks the rule that the images are shared only with the university accounts. Relying on an owner to keep it hardened also gives no test before release.
D. Wrong: Hardening at launch takes time, and the image itself is never tested before release. The requirement is a tested image that is rebuilt weekly, which first-boot scripts do not provide.
E. Right: Correct. Distribution settings can share an AMI with an organization or OU without making it public, and a pipeline schedule runs the build each week with no manual step. Together they meet the release and sharing rules. Learn more: Manage distribution settings (opens in a new tab)

Explanation

An Image Builder pipeline bakes the CIS hardening into an image through versioned components, tests it, and stops on failure. Distribution settings share the result with the organization only, and a schedule rebuilds it weekly. Manual builds, a public AMI and first-boot scripts each fail a stated requirement.

SCS-C03 practice question: Hardened AMIs and container images (EC2 Image Builder)

Explanation

Study

Keep practicing