Question

A security team is deploying workload protection across a fleet of production virtual machines in a public cloud IaaS environment. Many of these VMs are ephemeral and are frequently terminated and recreated by an autoscaling group. The team needs continuous vulnerability and configuration visibility but cannot tolerate performance overhead on the running instances or a lengthy onboarding process for each new VM. Which workload security approach best fits these constraints?

Accepted Answer

Use agentless scanning that snapshots the VM volumes via the cloud provider API to assess vulnerabilities and configuration

Answer

Deploy an agent-based workload protection sensor baked into each VM image and require it to run on every instance

Answer

Route all VM traffic through a network firewall and rely solely on signature-based IPS for workload protection

Answer

Install a host-based firewall on each instance and manually run vulnerability scans during maintenance windows