DOP-C02 Question 127
Select 3Your team is managing hundreds of EC2 instances across multiple AWS accounts, and you need to automate patch management to ensure instances are up-to-date with critical security updates. Additionally, you want to generate compliance reports to track which instances are not patched. Which combination of AWS services and features should you use to achieve this?
- A
AWS Systems Manager Patch Manager to automate patching and compliance reporting
- B
AWS Config with custom rules to track non-compliant instances
- C
AWS Lambda to manually trigger patching operations on EC2 instances
- D
AWS Systems Manager State Manager to enforce patch compliance policies
- E
Amazon CloudWatch to schedule patching events
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate patch management and compliance tracking, AWS Systems Manager Patch Manager is the primary service as it handles patching and provides compliance reporting. AWS Config complements this by tracking non-compliant instances through custom rules. Additionally, AWS Systems Manager State Manager helps enforce compliance by applying patch baselines automatically. This combination ensures a fully automated and monitored patch management workflow.
- A. Correct.
Correct: AWS Systems Manager Patch Manager is specifically designed to automate patching of EC2 instances and provides compliance reports to track patch status.
- B. Correct.
Correct: AWS Config can be used with custom rules to monitor and track resources, including identifying non-compliant EC2 instances for patching.
- C. Incorrect.
Incorrect: AWS Lambda is not required for this use case since AWS Systems Manager provides built-in automation for patch management.
- D. Correct.
Correct: AWS Systems Manager State Manager can be used to enforce compliance by applying patch baselines automatically to instances.
- E. Incorrect.
Incorrect: While Amazon CloudWatch can schedule events, it is not the right service for automating patch management or compliance tracking.