A financial company recently encountered an IT security incident for one of its AWS EC2 instances. An attacker used Kali Linux penetration testing tool to scan the company’s EC2 resources, found an EC2 configuration weaknesses and then gained unauthorized access. You need to work out a plan to make sure that all EC2 instances always meet patch compliance. A monitoring tool is also required for these kinds of potential security risks. Which approaches should you take in together to meet the requirements? (Select TWO.)

Answer options:

A.Use AWS Systems Manager Run Command to apply necessary patches every 30 days to ensure all EC2 instances are always patch compliant.
B.Configure patch baselines in AWS Systems Manager and use Patch Manager to apply patches in a maintenance window.
C.Configure AWS Macie to continuously monitor security issues for AWS resources. Configure SNS notifications based on Macie alarms in CloudWatch Events.
D.Configure monitoring dashboard in AWS QuickSight which uses machine learning skills to discover security incidents that are happening.
E.Enable AWS GuardDuty to monitor potential security incidents. Create CloudWatch Event rules based on the findings and trigger SNS notifications.

Correct Answer – B, E
Option A is incorrect: To meet patch compliance, the best tool is Patch Manager rather than Run Command. Option B should be chozen.
Option B is CORRECT: Because Patch Manager can easily apply necessary patches in EC2 instances according to established patch baselines.
Option C is incorrect: AWS Macie is a tool to scan security issues in S3 only. It can not discover issues mentioned in the question.
Option D is incorrect: Because QuickSight is a tool to create and publish interactive dashboards which can not monitor security risks.
Option E is CORRECT: Because AWS GuardDuty is appropriate to monitor the mentioned security issues. PenTest:IAMUser/KaliLinux is also a finding type of GuardDuty. GuardDuty will report this risk when a machine running Kali Linux is making API calls using credentials of your AWS account.