AWS Certified SysOps Administrator – Associate (legacy) — Question 524

A Security and Compliance team is reviewing Amazon EC2 workloads for unapproved AMI usage.
Which action should a SysOps Administrator recommend?

Answer options

• A. Create a custom report using AWS Systems Manager Inventory to identify unapproved AMIs
• B. Run Amazon Inspector on all EC2 instances and flag instances using unapproved AMIs
• C. Use an AWS Config rule to identify unapproved AMIs
• D. Use AWS Trusted Advisor to identify EC2 workloads using unapproved AMIs

Correct answer: C

Explanation

AWS Config is the ideal service for tracking resource compliance against desired configurations, and it includes managed rules (such as approved-amis-by-id) to specifically identify EC2 instances running unapproved AMIs. AWS Systems Manager Inventory collects software and configuration metadata but does not evaluate compliance rules for AMIs. Amazon Inspector focuses on vulnerability assessment and software security, while AWS Trusted Advisor does not have a check designed to validate AMI compliance.