CLF-C02 Cloud Technology and Services Practice Question
A company needs to ensure their containerized applications pass security scans for known vulnerabilities before being deployed to production. Which AWS service scans container images for CVEs?
⚠ Common exam trap
Watch out — candidates often confuse Amazon Inspector (which scans for CVEs in container images and EC2 instances) with Amazon GuardDuty (which detects threats but does not perform vulnerability scanning), leading them to select GuardDuty because of its security monitoring name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Inspector
Amazon Inspector is the correct service because it is designed to automatically scan container images stored in Amazon Elastic Container Registry (ECR) for software vulnerabilities, including Common Vulnerabilities and Exposures (CVEs). It continuously monitors the images at rest and during deployment, providing a detailed findings report that helps you remediate security issues before the container reaches production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and third-party threat intelligence to continuously monitor for malicious activity and unauthorized behavior across AWS workloads, including EC2 instances, S3, and IAM. It can detect runtime threats like cryptocurrency mining or suspicious API calls, but it does not statically scan container image layers for known vulnerabilities or CVEs—that type of software composition analysis is outside its scope.
- ✓
Amazon Inspector
Why this is correct
Amazon Inspector is the correct service because it continuously scans container images in Amazon ECR for software vulnerabilities, including known CVEs, using a constantly updated list of rules from the Common Vulnerabilities and Exposures database. When a vulnerability is found, Inspector assigns a risk score and provides detailed remediation guidance, making it the purpose-built service for finding security vulnerabilities in container images. Note that Inspector also scans Amazon EC2 instances and Lambda functions for vulnerabilities and network exposure.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from across AWS accounts, including Amazon Inspector's vulnerability scan results, and applies compliance frameworks like CIS and PCI DSS. While it can display and prioritize Inspector findings, it does not perform any underlying scanning or detection itself—it is a central console and alerting layer, not an image scanner.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3 buckets. It does not inspect container images, analyze package manifests, or identify CVEs; its purpose is data loss prevention within object storage, making it irrelevant to container image vulnerability scanning.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.