Use Systems Manager Inventory with AWS Config rules to identify prohibited applications

Why the Answer Is Correct

The requirement is to audit the EC2 fleet for prohibited installed applications with the most operational efficiency. AWS Systems Manager Inventory is the managed feature for collecting software inventory from instances, so it is configured on each instance as the data source. AWS Config can then evaluate that inventory continuously through rules that check for prohibited applications, which expresses the audit as declarative managed configuration rather than code, and Config evaluates on an ongoing basis so drift is caught without anyone running a scan (B). Using the two services together avoids deploying any custom collection or analysis code to the fleet, which is what makes it the most operationally efficient option. B is the correct answer.

Why the Other Options Are Wrong

A configures Systems Manager and Inventory but then adds Systems Manager resource data sync to synchronize and store findings in Amazon S3, plus an AWS Lambda function that runs when new objects are added to that bucket to identify prohibited applications. This introduces a bespoke export-and-process pipeline, an S3 bucket of intermediate data, and a function to operate, all of which must be maintained, when Inventory plus a Config rule already covers the requirement declaratively. C configures Systems Manager and Inventory but then filters a CloudTrail trail for Systems Manager Inventory events. CloudTrail records management API activity such as PutInventory calls; it does not contain the installed-software inventory contents of each instance, so prohibited applications cannot be identified by filtering it. D designates CloudWatch Logs as the log destination, runs an automated script across all instances to build an inventory of installed applications, forwards results to CloudWatch Logs, and alarms on filter patterns. This requires distributing, running, and maintaining a script on every instance rather than using the agent's built-in inventory, which is the opposite of operational efficiency. B is correct.

Community Comment Notes

Community voted B unanimously. jamesf identified the keywords as AWS Systems Manager, Systems Manager Inventory, and an AWS Config rule, which matches the three components of option B. limelight04 restated option B's three components as the supporting combination. getadroit cited the AWS Management Tools blog post on preventing blacklisted applications with Systems Manager and AWS Config, which is exactly this design. No alternative received support.