The correct choice is Amazon Inspector because it is designed to perform automated assessments of Amazon EC2 instances for known software vulnerabilities and to evaluate network reachability across VPCs so it can identify unintended exposure and produce consolidated findings and reports.

Amazon Inspector runs vulnerability scans that detect common vulnerabilities and exposures and it analyzes reachable network paths to show which services or ports are exposed. It aggregates findings into actionable reports so teams can prioritize remediation across multiple VPCs and instances.

AWS Config evaluates and records resource configurations and checks compliance against rules and baselines. It does not perform host level vulnerability scanning or network reachability analysis of running EC2 instances.

Amazon GuardDuty analyzes telemetry such as VPC Flow Logs and CloudTrail to detect suspicious or malicious activity. It is a threat detection service and not a vulnerability scanner that produces host vulnerability and reachability reports.

Amazon Macie focuses on discovering and protecting sensitive data in Amazon S3. It does not assess EC2 instances for software vulnerabilities or unintended network exposure.

Full AWS Practitioner Certification Question