Question

A security engineer uses Amazon Inspector to continuously scan a fleet of internet-facing and internal EC2 instances. Inspector reports thousands of package vulnerabilities, overwhelming the remediation team. Leadership wants the team to focus first on vulnerabilities that are both severe AND actually exploitable from the internet. Which Inspector capability should the engineer rely on to identify these highest-priority findings?

Accepted Answer

Sort findings by the Inspector risk score, which combines CVSS severity with network reachability and exploitability information for each finding

Answer

Filter findings by the raw CVSS base score alone and treat any score of 7.0 or higher as the top priority

Answer

Enable Inspector deep inspection to detect programming-language package vulnerabilities in application code paths

Answer

Create a suppression rule that hides all findings on internal instances so only internet-facing instance findings remain