Study guide
Technical reference and lesson notes
Purpose of This Lesson
Amazon Inspector helps identify security weaknesses in Amazon EC2 environments. It can assess externally reachable network ports and, when host-level data is available, identify vulnerable software, configuration weaknesses, and deviations from security best practices.
For SAP-C02, focus on the distinction between network assessments and host assessments, especially their data sources and agent requirements.
Key Concepts
Amazon Inspector assessment categories
Amazon Inspector can evaluate EC2 instances from two complementary perspectives:
- Network assessment: Determines which ports are reachable from outside the VPC based on the instance’s network configuration.
- Host assessment: Examines the instance operating system and installed software for known vulnerabilities, hardening issues, and security best-practice violations.
These assessments address different questions:
| Assessment | Primary question | Agent requirement in the lesson’s model |
|---|---|---|
| Network assessment | Which ports are externally reachable? | Basic network checks can run without an agent |
| Network assessment with host data | What processes are listening or reachable on exposed ports? | Requires an agent for the additional host information |
| Host assessment | Is the operating system or installed software vulnerable or insufficiently hardened? | Requires an agent |
Network assessments
Network assessments analyze the effective network exposure of EC2 instances. They help identify ports that may be reachable from outside the VPC because of combinations of:
- Security group rules
- Network ACL rules
- Routing and internet-facing connectivity
- Services listening on the instance
Without host-level visibility, the assessment is primarily concerned with network reachability. With the required agent and host information, Inspector can provide more detail about the processes associated with exposed ports.
A security group rule allowing inbound TCP port 22 from 0.0.0.0/0, for example, represents a potentially exposed SSH endpoint. Inspector can help surface this type of exposure, but it does not replace deliberate security-group design or application-level security testing.
Host assessments
Host assessments require an agent because the service needs information from inside the operating system. They can identify:
- Software containing known vulnerabilities, commonly represented by CVE identifiers
- Operating-system or package weaknesses
- Host-hardening issues
- Deviations from CIS benchmarks
- Violations of security best practices
The agent is installed on the EC2 instance. AWS Systems Manager can automate deployment and administration of the agent, including through Run Command, which is useful when many instances must be assessed consistently.
Scheduling and recurring assessments
Assessments can be configured to run on a recurring schedule. Scheduled scans are useful for detecting changes after:
- New software is installed
- Security-group or network rules are modified
- Operating-system packages are updated
- New vulnerabilities are published
- Instances are launched from different AMIs
A one-time scan provides only a point-in-time result. Continuous or recurring assessment is more appropriate for environments where instances and network configurations change frequently.
Pricing model in the lesson
The lesson describes pricing based on the number of instance assessments. When evaluating an exam scenario, distinguish this from unrelated AWS security services that charge by requests, data volume, rules evaluated, or findings processed.
AWS service pricing and Inspector capabilities have evolved over time. Older material may describe the original assessment-oriented Inspector model, while current AWS documentation may describe newer continuous vulnerability-management capabilities and additional resource types. Always interpret the agent and pricing details in the context of the service generation referenced by the question.
Exam-Relevant Takeaways
- Amazon Inspector is used to identify security exposures and vulnerabilities, particularly for EC2 workloads in this lesson.
- Network assessment focuses on externally reachable ports and network exposure.
- Basic network checks may not require an agent, but additional process-level visibility requires host information from an agent.
- Host assessment requires an agent and examines vulnerable software, CVEs, CIS benchmark issues, and hardening weaknesses.
- AWS Systems Manager can automate agent installation and management on EC2 instances.
- Inspector findings are security assessment results; they do not automatically fix security groups, patch software, or harden operating systems.
- Inspector complements, rather than replaces, security groups, network ACLs, patch management, vulnerability remediation, and secure configuration practices.
Architecture Decision Guide
| Requirement | Appropriate Inspector capability or approach | Important consideration |
|---|---|---|
| Find EC2 ports reachable from outside the VPC | Network assessment | Validate the effective network path and exposure |
| Determine which host processes are associated with exposed ports | Network assessment with host-level data | Requires the relevant agent and instance visibility |
| Detect vulnerable packages and operating-system software | Host assessment | Requires an agent in the lesson’s model |
| Check EC2 hardening against CIS guidance | Host assessment | Requires operating-system inspection |
| Deploy the assessment agent across many instances | AWS Systems Manager automation, such as Run Command | Instances must be managed by Systems Manager and meet its prerequisites |
| Recheck systems after configuration or software changes | Scheduled or recurring assessment | A single scan can become stale as the environment changes |
| Remediate a finding | Patch, reconfigure, or otherwise modify the workload | Inspector identifies issues; remediation is a separate operational activity |
Common Exam Traps
Confusing network and host assessments
A network assessment answers whether traffic can reach a port. It does not inherently provide complete information about installed packages or operating-system vulnerabilities. Those are host-assessment concerns.
Assuming all Inspector checks are agentless
Some network exposure checks can be performed without an agent, but host inspection requires access to information inside the operating system. Do not select an agentless solution when the requirement is to identify vulnerable software or CIS hardening violations on an EC2 instance.
Treating Inspector as a patching service
Inspector reports vulnerabilities and configuration findings. It does not automatically become the patch-management mechanism simply because it detects a vulnerable package. Use an appropriate patching and change-management process, often involving Systems Manager capabilities.
Replacing security groups with Inspector
Inspector can identify risky exposure, but security groups remain the primary instance-level network control. A finding that SSH is publicly reachable should generally lead to a security-group or access-design change, not reliance on Inspector to block the traffic.
Ignoring Systems Manager prerequisites
Using Systems Manager to install or manage an agent requires the instance to be configured for Systems Manager, including appropriate IAM permissions, connectivity, and management-agent prerequisites. Selecting Run Command alone does not guarantee successful installation.
Confusing Inspector with other AWS security services
- Amazon Inspector: Vulnerability and exposure assessment
- Amazon GuardDuty: Threat detection from AWS telemetry and workload activity
- AWS Security Hub: Centralized aggregation and prioritization of security findings
- Amazon Macie: Sensitive-data discovery and protection for Amazon S3
- AWS Config: Resource configuration history and compliance evaluation
A scenario asking for known vulnerable software on EC2 generally points toward Inspector, not GuardDuty or Config alone.
Real-World Engineer Notes
- Prioritize findings based on exploitability, network reachability, asset importance, and compensating controls rather than severity alone.
- A vulnerable package on an isolated private instance may have a different immediate risk profile from the same package on an internet-facing host.
- Use immutable AMIs and automated patch pipelines to reduce the time that vulnerable instances remain in service.
- Keep agent deployment and Systems Manager configuration in the instance-provisioning process instead of treating assessment coverage as a manual afterthought.
- Review both network exposure and host vulnerabilities. An instance can have fully patched software but still expose an unnecessary administrative port, or have a restricted network path but contain serious software vulnerabilities.
- Schedule assessments after major infrastructure changes and maintain an operational process for triaging, remediating, and documenting findings.
Quick Reference Summary
- Purpose: Find EC2 security exposures and vulnerabilities.
- Network assessment: Checks externally reachable ports and, with host data, can identify reachable processes.
- Host assessment: Checks CVEs, vulnerable software, CIS benchmarks, hardening, and security best practices.
- Agent: Required for host assessments and for enhanced process-level network information in the lesson’s model.
- Automation: AWS Systems Manager can install and manage the agent.
- Scheduling: Recurring assessments help detect changes over time.
- Remediation: Inspector reports findings; other operational processes fix them.
- Exam distinction: Choose Inspector for vulnerability and exposure assessment, not general threat detection or configuration history.
Flashcards
- Q: What is the primary purpose of Amazon Inspector in this lesson?
A: To assess EC2 instances for network exposure, software vulnerabilities, host-hardening issues, and security best-practice violations.
- Q: What does a network assessment examine?
A: Which ports on an EC2 instance are reachable from outside the VPC based on the effective network configuration.
- Q: What additional information can host-level access provide during network assessment?
A: Information about the processes reachable or listening on exposed ports.
- Q: Which Inspector assessment requires an agent?
A: Host assessment, because it needs information from inside the operating system.
- Q: What types of host issues can Inspector identify?
A: Known vulnerable software and CVEs, CIS benchmark deviations, hardening issues, and security best-practice violations.
- Q: Which AWS service can automate installation of the Inspector agent on EC2?
A: AWS Systems Manager, including Run Command or other automation mechanisms.
- Q: Does Inspector automatically patch a vulnerable package?
A: No. Inspector identifies the finding; patching and remediation are separate activities.
- Q: Why are recurring assessments preferable to a single scan?
A: EC2 software, network rules, and published vulnerabilities change over time, making one-time results stale.
- Q: Which service is more appropriate for detecting suspicious account or workload activity: Inspector or GuardDuty?
A: GuardDuty. Inspector focuses on vulnerability and exposure assessment.
- Q: What does a publicly reachable SSH port represent?
A: A network exposure that should be reviewed and usually restricted through security-group and access-design changes.
Practice Questions
Question 1
A security team must identify EC2 instances with operating-system packages containing known CVEs and verify compliance with CIS hardening recommendations. Which approach is most appropriate?
A. Use Amazon GuardDuty with VPC Flow Logs only
B. Use Amazon Inspector host assessments with the required agent installed
C. Use Amazon Macie to scan the instance file systems
D. Use AWS Shield Advanced to inspect the instances
Correct answer: B
Explanation: Host assessments require operating-system visibility and are designed to identify vulnerable software, CVEs, CIS benchmark issues, and hardening weaknesses. GuardDuty detects threats, Macie focuses on sensitive data in S3, and Shield protects against DDoS attacks.
Question 2
A company wants to discover whether EC2 instances have ports reachable from outside the VPC. It does not initially require package-level vulnerability information. Which Inspector capability should it use?
A. Network assessment
B. Host assessment
C. CIS compliance assessment through Macie
D. GuardDuty malware protection only
Correct answer: A
Explanation: Network assessments focus on externally reachable ports and network exposure. Package vulnerabilities and host hardening are host-assessment requirements.
Question 3
An organization has hundreds of EC2 instances and wants to install the Inspector agent consistently without logging in to each host. Which solution best meets the requirement?
A. Use AWS Systems Manager Run Command or automation to deploy the agent
B. Add an inbound rule to each security group
C. Configure an internet gateway to install the agent automatically
D. Enable Amazon Macie on the VPC
Correct answer: A
Explanation: Systems Manager can automate agent installation and administration across managed EC2 instances. Security groups and internet gateways provide networking, not host software deployment.
Question 4
Inspector reports that an EC2 instance has an internet-reachable administrative port. What is the most direct remediation?
A. Disable all Inspector schedules
B. Modify the security-group or network configuration to restrict access
C. Install GuardDuty on the instance
D. Move the finding to an S3 bucket
Correct answer: B
Explanation: Inspector identifies the exposure, while the network configuration must be changed to restrict unnecessary access. A security group should typically allow administration only from approved sources, such as a bastion path, VPN, or Systems Manager access.
Question 5
A team runs one Inspector assessment after deploying an EC2 fleet and assumes the results remain valid indefinitely. Which statement best explains the problem?
A. Inspector findings never include network information
B. EC2 software, vulnerabilities, and network rules can change, so recurring assessments are needed
C. Inspector can only assess instances during an AMI build
D. Inspector findings are valid only when the instance is stopped
Correct answer: B
Explanation: A one-time assessment is a snapshot. Recurring assessments are needed to detect newly introduced exposure, newly published vulnerabilities, and configuration or software changes.