AWS DevOps Engineer Professional Practice Test

What two items are required for AWS Inspector to operate on EC2 instances?

1. SSM agent must be installed and an EC2 role with SSM Run Command privileges

2. Inspector agent must be installed and EC2 instances must run on Linux

3. CloudTrail must be enabled and an EC2 role with CloudWatch permissions

4. VPC flow logs must be enabled and an EC2 role with IAM permissions

The correct answer is: SSM agent must be installed and an EC2 role with SSM Run Command privileges

For AWS Inspector to effectively operate on EC2 instances, it is essential for the SSM (Systems Manager) agent to be installed on the instances. This agent facilitates the communication between the instances and the Inspector service, allowing the service to perform assessments accurately and receive any necessary updates or configurations. In addition to the presence of the SSM agent, the instances must also have an appropriate EC2 role with SSM Run Command privileges. This role grants the necessary permissions to the Inspector for executing commands on the instances, enabling it to carry out the required assessments and scans effectively. These two components—having the SSM agent installed and the correct EC2 role configured—ensure that AWS Inspector can perform its tasks, such as vulnerability scanning and compliance checks, seamlessly. Without either of these, the Inspector would not function properly, resulting in an inability to conduct the necessary security assessments on the EC2 instances.