Which AWS Service Finds EC2 Security Vulnerabilities?
Which AWS offering can analyze a company’s AWS environment to discover security vulnerabilities on Amazon EC2 instances?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of AWS security services by function: Inspector discovers software vulnerabilities and network reachability issues on EC2, while the trap is picking Macie, Shield, or Security Groups because they also 'sound security-related' but perform entirely different jobs.
Amazon Inspector is the AWS automated vulnerability management service that continuously scans Amazon EC2 instances (as well as ECR container images and AWS Lambda functions) to discover software vulnerabilities and unintended network exposure. On the CLF-C02 exam, Inspector is the answer whenever a question asks about discovering security vulnerabilities or unintended access across compute workloads.
The most common wrong choice is B, Amazon Macie, because learners associate it with 'finding security problems in AWS.' Macie uses machine learning to discover, classify, and protect sensitive data stored in Amazon S3 — it does not assess EC2 instances for software vulnerabilities. C (Shield Standard) only mitigates DDoS attacks, and D (Security Groups) is a preventive virtual firewall, not an analysis tool.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon Inspector is an automated security assessment service that continuously scans AWS workloads — specifically Amazon EC2 instances, Amazon ECR container images, and Lambda functions — to identify unintended network exposure, high-risk software vulnerabilities, and deviations from security best practices. Its findings are risk-scored and prioritized, and Inspector integrates with AWS Systems Manager Patch Manager for automatic remediation, which matches the question's wording about analyzing an environment to discover security vulnerabilities on EC2. This is exactly the service's purpose as described in the AWS documentation and Cloud Practitioner blueprint under security resources.Why the Other Options Are Wrong
Amazon Macie is a data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3; it does not scan EC2 instances for software vulnerabilities. AWS Shield Standard is a no-cost DDoS protection service that automatically safeguards applications running on AWS against layer 3/4 attacks — it performs no vulnerability analysis of instances. Security groups are stateful virtual firewall controls that filter traffic as a preventive measure; they are configured by administrators and provide no analysis, assessment, or discovery capability of any kind.Community Comment Notes
The community response was unanimous, with every vote and comment selecting A. As Nikmah summarized the service scope: "Inspector: find software vulnerabilities in EC2, ECR Images, and Lambda functions," which precisely matches the assessment scope the question describes. ShaiTay and another learner independently confirmed A without dispute, and no comment defended any competing option, so the vote distribution here aligns with the documented behavior of the service.Official Reference
Exam Strategy
On CLF-C02, match each security service to its single defining job: Inspector = vulnerability assessment of EC2/ECR/Lambda, Macie = sensitive data discovery in S3, Shield = DDoS protection, GuardDuty = threat detection via logs, WAF = layer 7 request filtering. If the stem says 'discover or assess vulnerabilities on instances,' the answer is Amazon Inspector without exception.
Frequently Asked Questions
How is Amazon Inspector different from Amazon Macie for this EC2 vulnerability question?
Inspector assesses EC2 instances, ECR images, and Lambda functions for software vulnerabilities and network exposure. Macie is an S3 data-protection service that finds and classifies sensitive data, so it cannot assess EC2 workloads.
Why aren't Security Groups or AWS Shield the answer for discovering vulnerabilities?
Security groups are preventive firewalls that filter traffic; they do not analyze or report vulnerabilities. Shield Standard only mitigates DDoS attacks at the network layer, performing no instance-level vulnerability assessment.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →