Exam AWS-SysOps topic 1 question 791 discussion

C. Use an AWS Config rule to identify unapproved AMIs

The correct answer is: A. Create a custom report using AWS Systems Manager Inventory to identify unapproved AMIs Explanation: AWS Systems Manager Inventory provides a centralized inventory of resources, including EC2 instances and their associated AMIs. By creating a custom report, the SysOps Administrator can easily identify instances running unapproved AMIs, allowing the Security and Compliance team to take appropriate action. Here's why the other options are not the best choices: B. Amazon Inspector is a security assessment service, not designed for identifying unapproved AMIs. C. AWS Config rules can monitor resource configurations, but aren't ideal for identifying unapproved AMIs in use. D. AWS Trusted Advisor provides best practice recommendations, but doesn't specifically identify unapproved AMIs. By using AWS Systems Manager Inventory, the Administrator can quickly and effectively identify unapproved AMI usage, addressing the Security and Compliance team's concerns.

AWS Config is a service that allows you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors the configuration changes and compliance of the AWS resources in your account against predefined rules, called AWS Config rules.

C is the answer

Answer is C https://aws.amazon.com/blogs/devops/aws-config-checking-for-compliance-with-new-managed-rule-options/ AWS Config rules can now check that running instances are using approved Amazon Machine Images, or AMIs. You can specify a list of approved AMI by ID or provide a tag to specify the list of AMI Ids.

I'll go with C

C. Use an AWS Config rule to identify unapproved AMIs

C AWS Config rules can now check that running instances are using approved Amazon Machine Images, or AMIs. You can specify a list of approved AMI by ID or provide a tag to specify the list of AMI Ids.

C https://aws.amazon.com/blogs/devops/aws-config-checking-for-compliance-with-new-managed-rule-options/