Which combination of actions will meet these requirements?

By:
In: SAP-C02
Tagged:
With: 2 Comments
A company has several AWS Lambda functions written in Python.The functions are deployed with the .zip package deployment type.The functions use a Lambda layer that contains common libraries and packages in a .zip file.The Lambda .zip packages and Lambda layer .zip file are stored in an Amazon S3 bucket.The company must implement automatic scanning of the Lambda functions and the Lambda layer to identify CVEs.A subset of the Lambda functions must receive automated code scans to detect potential data leaks and other vulnerabilities.The code scans must occur only for selected Lambda functions, not all the Lambda functions.

Which combination of actions will meet these requirements?

(Choose three.)

Activate Amazon Inspector. Start automated CVE scans.

Activate Lambda standard scanning and Lambda code scanning in Amazon Inspector.

Enable Amazon GuardDuty. Enable the Lambda Protection feature in GuardDuty.

Enable scanning in the Monitor settings of the Lambda functions that need code scans.

Tag Lambda functions that do not need code scans. In the tag, include a key of InspectorCodeExclusion and a value of LambdaCodeScanning.

Use Amazon Inspector to scan the 3 bucket that contains the Lambda .zip packages and the Lambda layer .zip file for code scans.

Explanations:

Activating Amazon Inspector and starting automated CVE scans will help identify known vulnerabilities (CVEs) in the Lambda functions and layers. This is a required step for CVE scanning.

Enabling both standard and code scanning in Amazon Inspector for Lambda allows for the detection of CVEs and potential code issues in the selected Lambda functions.

Amazon GuardDuty’s Lambda Protection feature is focused on monitoring runtime threats, not on CVE or code scanning, making it unsuitable for this requirement.

There is no option within Lambda’s Monitor settings specifically to enable selective code scans for Inspector; code scans are configured directly in Inspector.

Tagging Lambda functions to exclude certain functions from code scanning by Amazon Inspector allows for the selective scanning required in this scenario.

Amazon Inspector does not scan S3 buckets for Lambda code; it directly scans Lambda functions, so this approach does not meet the requirements.

2026-03-24

2 Comments

  1. Abigail
    Author

    If I’m correct, the answer is:
    Activate Amazon Inspector. Start automated CVE scans.

  2. Christian
    Author

    From my perspective, the answer is:
    Activate Amazon Inspector. Start automated CVE scans.

Leave a Reply to Christian Cancel reply

Your email address will not be published. Required fields are marked *

8 − 2 =