Which AWS Service Finds EC2 Security Vulnerabilities?
Short answer
A Amazon Inspector automatically scans the AWS environment to discover security vulnerabilities and unintended network exposure on Amazon EC2 instances.
Question
Key Takeaways
The question tests recognition of AWS security services by function: Inspector discovers software vulnerabilities and network reachability issues on EC2, while the trap is picking Macie, Shield, or Security Groups because they also 'sound security-related' but perform entirely different jobs.
Amazon Inspector is the AWS automated vulnerability management service that continuously scans Amazon EC2 instances (as well as ECR container images and AWS Lambda functions) to discover software vulnerabilities and unintended network exposure. On the CLF-C02 exam, Inspector is the answer whenever a question asks about discovering security vulnerabilities or unintended access across compute workloads.
Common mistake: The most common wrong choice is B, Amazon Macie, because learners associate it with 'finding security problems in AWS.' Macie uses machine learning to discover, classify, and protect sensitive data stored in Amazon S3 — it does not assess EC2 instances for software vulnerabilities. C (Shield Standard) only mitigates DDoS attacks, and D (Security Groups) is a preventive virtual firewall, not an analysis tool.
Expert Analysis
Why the Answer Is Correct
Amazon Inspector is an automated security assessment service that continuously scans AWS workloads — specifically Amazon EC2 instances, Amazon ECR container images, and Lambda functions — to identify unintended network exposure, high-risk software vulnerabilities, and deviations from security best practices. Its findings are risk-scored and prioritized, and Inspector integrates with AWS Systems Manager Patch Manager for automatic remediation, which matches the question's wording about analyzing an environment to discover security vulnerabilities on EC2. This is exactly the service's purpose as described in the AWS documentation and Cloud Practitioner blueprint under security resources.
Why the Other Options Are Wrong
Amazon Macie is a data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3; it does not scan EC2 instances for software vulnerabilities. AWS Shield Standard is a no-cost DDoS protection service that automatically safeguards applications running on AWS against layer 3/4 attacks — it performs no vulnerability analysis of instances. Security groups are stateful virtual firewall controls that filter traffic as a preventive measure; they are configured by administrators and provide no analysis, assessment, or discovery capability of any kind.
Community Comment Notes
The community response was unanimous, with every vote and comment selecting A. As Nikmah summarized the service scope: "Inspector: find software vulnerabilities in EC2, ECR Images, and Lambda functions," which precisely matches the assessment scope the question describes. ShaiTay and another learner independently confirmed A without dispute, and no comment defended any competing option, so the vote distribution here aligns with the documented behavior of the service.
Official Reference
https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
On CLF-C02, match each security service to its single defining job: Inspector = vulnerability assessment of EC2/ECR/Lambda, Macie = sensitive data discovery in S3, Shield = DDoS protection, GuardDuty = threat detection via logs, WAF = layer 7 request filtering. If the stem says 'discover or assess vulnerabilities on instances,' the answer is Amazon Inspector without exception.
Frequently Asked Questions
How is Amazon Inspector different from Amazon Macie for this EC2 vulnerability question?
Why aren't Security Groups or AWS Shield the answer for discovering vulnerabilities?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
Nikmah 👍 1 Answered A• Inspector: find software vulnerabilities in EC2, ECR Images, and Lambda functions
-
ShaiTay 👍 1 Answered AA. Amazon Inspector
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →