Examice

Exam SAP-C02 All QuestionsBrowse all questions from this exam

Question 519

A company has several AWS Lambda functions written in Python. The functions are deployed with the .zip package deployment type. The functions use a Lambda layer that contains common libraries and packages in a .zip file. The Lambda .zip packages and Lambda layer .zip file are stored in an Amazon S3 bucket.

The company must implement automatic scanning of the Lambda functions and the Lambda layer to identify CVEs. A subset of the Lambda functions must receive automated code scans to detect potential data leaks and other vulnerabilities. The code scans must occur only for selected Lambda functions, not all the Lambda functions.

Which combination of actions will meet these requirements? (Choose three.)

Activate Amazon Inspector. Start automated CVE scans.

Activate Lambda standard scanning and Lambda code scanning in Amazon Inspector.

Enable Amazon GuardDuty. Enable the Lambda Protection feature in GuardDuty.

Enable scanning in the Monitor settings of the Lambda functions that need code scans.

Tag Lambda functions that do not need code scans. In the tag, include a key of InspectorCodeExclusion and a value of LambdaCodeScanning.

Use Amazon Inspector to scan the 3 bucket that contains the Lambda .zip packages and the Lambda layer .zip file for code scans.

Correct Answer: A, B, D

To meet the requirements, first, activate Amazon Inspector to start automated CVE scans. Second, activate Lambda standard scanning and Lambda code scanning within Amazon Inspector to specifically target Lambda functions for scanning. Third, enable scanning in the Monitor settings of the Lambda functions that need code scans, ensuring that only the selected functions receive automated code scans to detect potential data leaks and other vulnerabilities.

Discussion

vip2Options: ABE

A, B and E Inspector for Lamda std scanning and code scanning Lambda Function with monitor setting to code scan Tag for conditional function, not for all functions