ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Installing the built-in Microsoft Defender Antivirus that ships with Windows Server provides real-time, on-access malware detection and removal. Signature updates are delivered automatically through Windows Update, and the service can be centrally configured and monitored at scale by using AWS Systems Manager capabilities such as State Manager and Run Command. This meets the policy's need for continuous protection, automated updates, and centralized administration without incurring extra licensing or introducing additional infrastructure.

Amazon GuardDuty malware protection only scans EBS snapshots triggered by GuardDuty findings and does not deliver continuous on-access protection or quarantine. Deploying a third-party virtual appliance gateway would not protect files already resident on the servers themselves. Periodic off-host scanning with Amazon Inspector or external tools lacks real-time detection and quarantine, leaving gaps between scans. Therefore, using the native Defender AV on each instance and managing it through Systems Manager is the most appropriate solution.