You are working as a SysOps administrator for a large financial organization using AWS EC2 instance for its extranet applications. To enhance the security of new Linux-based EC2 instances, management has decided to automate vulnerability checks for future instance launches to include Amazon Inspector. You are evaluating different ways to install Amazon Inspector on these new EC2 instances that are launched continuously in a large number based upon user demand. The security team has a mandate that no additional agent needs to be part of this installation process. Which of the following would help install Amazon Inspector automatically in the most secure way with the least effort?

Answer options:

A.Use CloudWatch Events to trigger the Lambda function, which will execute Amazon EC2 Systems Manager to install Amazon Inspector.
B.Use Amazon Linux 2 AMI with Amazon Inspector Agent.
C.Use Amazon EC2 Systems Manager Run Command to install Amazon Inspector.
D.Use EC2 User Data Feature to install Amazon Inspector using script.

Correct Answer – B
You can use the Amazon Linux 2 AMI with Amazon Inspector Agent which has the agent preinstalled and requires no additional steps to install or set up the agent. To start using Amazon Inspector with these EC2 instances, tag them to match the assessment target that you want. The configuration of Amazon Linux 2 AMI with Amazon Inspector Agent enhances security by focusing on two main security goals: limiting access and reducing software vulnerabilities.
https://docs.aws.amazon.com/inspector/latest/userguide/inspector_installing-uninstalling-agents.html#ami-with-agent
Option A is incorrect. However, this is a fully automated process to install Amazon Inspector once the EC2 instance is in running state. This will also require the EC2 Systems Manager agent to be installed.
Option C is incorrect as for running Amazon EC2 Systems Manager, EC2 Systems Manager agent needs to be installed which is not required by Security Team.
Option D is incorrect as although this is without any agent, this will incur additional admin work to configure the bash script each time an EC2 instance is launched.
 For more information on installing Amazon Inspector, refer to the following URL-
https://aws.amazon.com/inspector/faqs/