A township wants continuous vulnerability assessment of EC2 instances and container images in Amazon ECR as part of its secure workload posture. Which AWS service should the architect select for that scanning use case?
Select an answer to reveal the explanation.
Short Explanation
Inspector is the township’s scheduled building inspection for servers and images—finding cracked pipes (CVEs) on EC2 and ECR. Macie hunts sensitive data, Artifact is paperwork, and QuickSight is charts—not the vulnerability scanner.
Full Explanation
Continuous vulnerability assessment of EC2 instances and Amazon ECR container images is the job of Amazon Inspector in Associate-level secure-workload design. Inspector discovers CVEs and related findings on eligible hosts and images, then feeds those findings into security posture workflows—Security Hub aggregation, EventBridge automation, ticket queues, and patch pipelines. Selecting Inspector aligns the township’s "find cracked pipes before citizens rely on them" goal with an AWS-native assessment engine rather than unrelated compliance or analytics products.
Amazon Macie alone fails this use case by concept: Macie discovers sensitive data in S3, not host/image CVE inventories across compute types. AWS Artifact alone fails because downloading a compliance PDF does not scan instances or patch anything; Artifact is evidence of AWS’s controls, not your runtime vulnerability feed. Amazon QuickSight alone fails because dashboards visualize data they are given—they do not invent CVE findings without an assessment engine underneath.
Exam caveat: Inspector findings are not remediation by themselves; pair scanning with patch management (Systems Manager), image rebuild pipelines, and admission controls so critical CVEs cannot linger on production AMI or image tags. Operational check: enable EC2 and ECR scanning, launch a known-vulnerable test image in a non-prod account, confirm Inspector emits findings, and verify those findings appear in the township’s security workflow within the expected SLA.