ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring) / Question 1

SCS-C03 practice question: Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)

Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

An insurance company uses Amazon Inspector across its organization, managed from a delegated administrator account. The Inspector dashboard shows about 120 EC2 instances that are not scanned for software vulnerabilities.

These instances run vendor Linux appliances on EBS volumes, and the vendor contracts forbid installing any extra software, including the SSM Agent. The rest of the fleet already reports through the agent.

The security team wants vulnerability findings for every instance in Inspector, without new tooling to run.

Which solution meets these requirements with the LEAST operational overhead?

Choose one answer.

  1. A. Install the SSM Agent on the vendor appliances through a State Manager association, so that Inspector scans them with the agent-based method like the rest of the fleet.
  2. B. From the Inspector delegated administrator account, set the EC2 scan mode to hybrid, so that instances without the SSM Agent are scanned from EBS snapshots.
  3. C. Rely on the Inspector network reachability findings for the appliances, because those checks need no software on the instance and already run for the whole EC2 fleet.
  4. D. Run a third-party scanner on an EC2 instance that signs in to each appliance over SSH every night, and import its results into Security Hub CSPM as custom findings.
Show the answer and explanation

Answer: B

  • A. Wrong: Agent-based scanning would cover the appliances, but installing the SSM Agent breaks the vendor contracts that forbid extra software. The agentless method gives vulnerability findings without touching the appliances.
  • B. Right: Correct. Hybrid scanning keeps agent-based scans for managed instances and scans unmanaged instances by reading snapshots of their EBS volumes, with nothing installed. The delegated administrator setting applies to every member account. Learn more: Scanning Amazon EC2 instances with Amazon Inspector (opens in a new tab)
  • C. Wrong: Network reachability findings show open paths and exposed ports, not vulnerable software packages. The team needs vulnerability findings for the appliances, which these checks do not produce.
  • D. Wrong: This adds a scanner, its credentials and an import job that the team must run, which is the new tooling it wants to avoid. The results would also sit outside Inspector rather than beside its other findings.

Explanation

Inspector hybrid scan mode keeps agent-based scanning where the SSM Agent runs and scans other EBS-backed instances from snapshots, with no software on the instance. The delegated administrator sets it once for the organization. Installing the agent breaks the contracts, reachability findings are not vulnerability findings, and a self-run scanner is new tooling.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)All Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring) questions

Want more on Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)? The 5 full-length practice sets have 5 more Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets