Exams / SCS-C03 / Study guide / Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)
Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring): SCS-C03 study notes and practice questions
What to know about Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring) for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a fleet with an unknown patch state, a newly published CVE that needs triage, or a compliance rule to patch within a set number of days. You choose the service that finds the weakness, the one that fixes it and the one that proves it.
Find: Amazon Inspector
Inspector scans EC2 instances, Amazon ECR container images and Lambda functions continuously for CVEs in operating system packages and application dependencies. It also reports network exposure for EC2 instances.
EC2 scanning works through the Systems Manager agent, or in agentless mode, which scans snapshots of the instance’s EBS volumes without installing anything.
Each finding carries a risk score that combines the CVSS severity with exposure, such as whether the resource is reachable from the internet and whether an exploit is known. Triage by that score, not by CVSS alone.
Findings flow to AWS Security Hub and EventBridge, which lets you automate the response.
Fix: Systems Manager Patch Manager
Patch baselines define which patches are approved and when, with approval rules and an auto-approval delay.
Patch groups and maintenance windows decide which instances patch and when, so patching does not take the whole fleet down at once.
Compliance reporting shows each instance’s patch state for audit evidence.
Runtime Monitoring uses a GuardDuty security agent on EC2, Amazon ECS (including Fargate) and Amazon EKS to detect threats while workloads run, such as a crypto-mining process or a reverse shell.
It answers “is something misbehaving now?” It does not list the CVEs a resource carries.
How to choose
Scenario wording
Pick
List CVEs across EC2, container images and Lambda
Amazon Inspector
Scan EC2 instances without installing agents
Inspector agentless scanning
Install approved OS patches weekly, with compliance reports
Patch Manager with a baseline and maintenance window
Detect a running crypto miner on EKS nodes
GuardDuty Runtime Monitoring
Rank findings by real exposure
Inspector risk score
Fix a vulnerable container image
Rebuild the image and redeploy it
Common traps
GuardDuty as a vulnerability scanner. It detects threats in activity. Inspector finds weaknesses.
Patching a running container in place. The change disappears at the next launch. Rebuild and redeploy.
Scanning once instead of continuously, on a fleet that changes every day.
Patching every instance at once with no maintenance window, which can cause the outage the requirement forbids.
Ignoring exposure. A medium-severity finding on an internet-facing instance can matter more than a high one on an isolated host.
An insurance company uses Amazon Inspector across its organization, managed from a delegated administrator account. The Inspector dashboard shows about 120 EC2 instances that are not scanned for software vulnerabilities.
These instances run vendor Linux appliances on EBS volumes, and the vendor contracts forbid installing any extra software, including the SSM Agent. The rest of the fleet already reports through the agent.
The security team wants vulnerability findings for every instance in Inspector, without new tooling to run.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Install the SSM Agent on the vendor appliances through a State Manager association, so that Inspector scans them with the agent-based method like the rest of the fleet.
BB. From the Inspector delegated administrator account, set the EC2 scan mode to hybrid, so that instances without the SSM Agent are scanned from EBS snapshots.
CC. Rely on the Inspector network reachability findings for the appliances, because those checks need no software on the instance and already run for the whole EC2 fleet.
DD. Run a third-party scanner on an EC2 instance that signs in to each appliance over SSH every night, and import its results into Security Hub CSPM as custom findings.
Show the answer and explanation
Answer: B
A. Wrong: Agent-based scanning would cover the appliances, but installing the SSM Agent breaks the vendor contracts that forbid extra software. The agentless method gives vulnerability findings without touching the appliances.
C. Wrong: Network reachability findings show open paths and exposed ports, not vulnerable software packages. The team needs vulnerability findings for the appliances, which these checks do not produce.
D. Wrong: This adds a scanner, its credentials and an import job that the team must run, which is the new tooling it wants to avoid. The results would also sit outside Inspector rather than beside its other findings.
Explanation
Inspector hybrid scan mode keeps agent-based scanning where the SSM Agent runs and scans other EBS-backed instances from snapshots, with no software on the instance. The delegated administrator sets it once for the organization. Installing the agent breaks the contracts, reachability findings are not vulnerability findings, and a self-run scanner is new tooling.
Want more on Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)? The 5 full-length practice sets have 5 more Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)