ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

AWS Systems Manager provides a managed File Integrity Monitoring (FIM) capability that uses the existing SSM Agent on each EC2 instance to collect file metadata at regular intervals. The data is stored in Systems Manager Inventory and evaluated by AWS Config, which records and notifies on any additions, deletions, or modifications. The SSM Agent communicates outbound over HTTPS, so no extra inbound ports are needed, and because the capability is managed, administrators only need to enable the AWS-provided FIM configuration policy-satisfying the low-maintenance requirement.

Amazon GuardDuty analyzes VPC flow logs, DNS logs, EBS volume data, and CloudTrail events (with optional runtime monitoring agents), but its findings are focused on threat detections such as malware, not on file-integrity baselines for arbitrary system paths. AWS Network Firewall operates at the network layer and has no visibility into on-host file activity. Amazon Inspector offers continuous vulnerability scanning and CIS benchmark assessments but does not track file changes, so it does not meet the integrity-monitoring requirement.