Defining EC2 Instance Security Standards and Best Practices
Question
With a focus on the Well-Architected Framework's security pillar, you want to define standards and best practices for your EC2 instances and validate adherence to these standards so as the workload security is enhanced.
Which of the below would you choose?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Answer: B.
Option A is Incorrect.
Amazon Detective is a security service that makes use of AI making it easy for the users to identify, analyse and investigate security issues or suspicious activities.
Amazon Detective offers advantages in terms of swifter investigations by providing visualizations that are easy to use.
Option B is Correct.
Amazon Inspector is a tool to perform security assessment.
Inspector gives us ability to define standards and best practices and assesses adherence to these standards.
Option C is Incorrect.
AWS Security Hub is an AWS service that gives a comprehensive view of security alerts and other security related information from across different AWS accounts, services and other configured 3rd party applications.
Option D is Incorrect.
AWS Resource Access Manager (RAM) is a service that enables users to share AWS resources easily and securely.
The resources could be shared with any AWS account or within your AWS Organization.
References:
https://aws.amazon.com/detective/ https://aws.amazon.com/inspector/ https://aws.amazon.com/security-hub/ https://aws.amazon.com/ram/If you want to define standards and best practices for your EC2 instances and validate adherence to these standards, the best choice would be AWS Inspector.
AWS Inspector is a security assessment service that helps improve the security and compliance of your applications running on Amazon EC2 instances. It can identify security issues by analyzing your EC2 instances against predefined rules for common security vulnerabilities.
With AWS Inspector, you can define rules packages that include best practices and security standards. You can then run assessments on your EC2 instances to validate adherence to these standards. Inspector provides a detailed report that includes recommendations to remediate identified security issues.
Amazon Detective is a security service that makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities. It's not specifically designed to define standards and best practices for your EC2 instances.
AWS Security Hub is a comprehensive security service that provides central visibility into your security and compliance posture across your AWS accounts. While it provides insights and recommendations on potential security issues, it's not designed to define standards and best practices for your EC2 instances.
AWS Resource Access Manager (RAM) is a service that allows you to share AWS resources across AWS accounts. It's not designed to improve the security of your EC2 instances.
Therefore, the best answer for the given question would be B. AWS Inspector.
