A school district wants continuous vulnerability visibility for Amazon EC2 instances and container images used by student-facing systems. Which service prescription best meets this need?
Select an answer to reveal the explanation.
Short Explanation
Student systems need a smoke alarm that stays on—not a yearly fire drill checklist. Amazon Inspector keeps scanning EC2 and images and pushes findings to the security team. VPN walls do not patch CVEs, and GameLift is not a vuln scanner (or even in scope here).
Full Explanation
Continuous vulnerability visibility for school-district EC2 instances and container images used by student-facing systems is the job of Amazon Inspector. Inspector continuously scans eligible EC2 hosts and container images, producing CVE findings that should flow into the district’s centralized security workflow (Security Hub, ticketing, or both). That automation replaces occasional spreadsheet reviews with ongoing coverage aligned to how quickly student systems change.
Relying only on occasional manual CVE spreadsheet reviews without agent or image scanning cannot keep pace with new CVEs or image rebuilds. Disabling all vulnerability scanning because systems sit behind a VPN confuses network location with patch posture—VPN does not remove vulnerable packages. Amazon GameLift fleet metrics measure game-session capacity, not vulnerability management signals for student SIS or LMS hosts.
Exam caveat: Inspector covers EC2 and container image scanning in modern deployments; GuardDuty is threat detection, not a CVE inventory replacement—know which tool answers “vulnerability visibility.” Operational check: enable Inspector across the student-system accounts, confirm agent/SSM coverage on EC2, scan a representative container image pipeline, route findings to Security Hub, and verify remediation tickets open for high-severity CVEs.