A company runs vulnerability scans for EC2 instances across many member accounts in an AWS Organization. VPCs attach to a shared transit gateway and egress via a central egress VPC. Amazon Inspector is enabled from a delegated administrator account, but some instances appear in Inspector’s “not scanning” list. Which combination of actions should the DevOps engineer take to fix this? (Choose three.)

Amazon Inspector leverages AWS Systems Manager (SSM) Agent to perform vulnerability scans on EC2 instances. Therefore, the SSM Agent must be installed and running on the instances for Inspector to scan them. Instances also need outbound connectivity to the SSM service endpoints over HTTPS (port 443) to communicate with SSM. This is typically achieved by configuring appropriate security group rules. Finally, the EC2 instances require an IAM instance profile with permissions to interact with SSM, allowing the SSM Agent to register and communicate with the SSM service. Incorrect options: Granting inspector:StartAssessmentRun permissions to the DevOps engineer's IAM role is irrelevant to instances not being scanned; this permission is for initiating scans, not for enabling the scanning of instances. Configuring EC2 Instance Connect is for secure shell access to instances and does not affect Inspector's ability to scan. Creating a managed-instance activation is for registering on-premises servers or VMs with SSM, not for EC2 instances, which register automatically if the agent is installed and has proper permissions.