SCS-C03 practice question: Finding vulnerabilities in code and pipelines (Inspector code security, Amazon Q Developer)
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A SaaS startup keeps its application code, its Terraform infrastructure code and its dependency lock files in Git repositories. Two recent problems were found only after deployment. A vulnerable library came in through a lock file, and a Terraform change opened a database port to the internet.
The security team wants source code, dependencies and infrastructure code scanned before deployment, with the findings shown beside its other Amazon Inspector findings. Developers should not have to install and run a scanner themselves.
Which solution meets these requirements?
Choose one answer.
AA. Turn on Inspector EC2 scanning on the build servers, so that the packages installed on them are checked for vulnerabilities each day.
BB. Add an open-source scanner to every build script, and store its reports in an S3 bucket that the security team reviews each week for new problems.
CC. Run Amazon Inspector only on container images in Amazon ECR after each push, so that the code and its libraries are checked when the image is built.
DD. Connect the Git repositories to Amazon Inspector code security, so that code, dependencies and infrastructure as code are scanned and reported in Inspector.
Show the answer and explanation
Answer: D
A. Wrong: EC2 scanning checks operating system packages and software on running instances. It does not check the source code, lock files or Terraform in the repositories, so both problems would still reach production.
B. Wrong: A build script scanner can work, but developers must maintain it, and a weekly review is too late for these problems. Reports in S3 also sit outside the Inspector findings the team already uses.
C. Wrong: Image scanning finds vulnerable packages inside an image, but it does not check the Terraform or the source code itself. The open database port would not be found by this scan.
D. Right: Correct. Code security scans the repositories directly for code flaws, vulnerable dependencies and infrastructure as code problems. Findings appear in Inspector beside the other findings, and developers need no scanner of their own. Learn more: Amazon Inspector Code Security (opens in a new tab)
Explanation
Inspector code security scans the repositories themselves, covering code, dependencies and infrastructure as code, and it reports into Inspector. Scanning running instances, reviewing reports weekly and scanning only images each miss one of the stated problems.
Want more on Finding vulnerabilities in code and pipelines (Inspector code security, Amazon Q Developer)? The 5 full-length practice sets have 5 more Finding vulnerabilities in code and pipelines (Inspector code security, Amazon Q Developer) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →