SAP-C02 Question 392
Select 3A company wants to automate the patching of its fleet of Amazon EC2 instances across multiple AWS Regions. The solution must ensure that patches are applied during specific maintenance windows and that compliance reports are generated for auditing purposes. Which solution should be implemented using AWS Systems Manager?
- A
Use Systems Manager Patch Manager to define patch baselines and associate them with Patch Groups.
- B
Use Systems Manager Maintenance Windows to schedule the patching tasks during specific time periods.
- C
Manually SSH into each EC2 instance to apply patches and generate compliance reports using custom scripts.
- D
Use Systems Manager State Manager to enforce the installation of patches across all instances.
- E
Enable AWS Config to monitor patch compliance across all instances.
Show answer and explanation
Correct answers: A, B, E
Explanation
To automate patching across EC2 instances, AWS Systems Manager's Patch Manager is the correct tool for defining and applying patches. Maintenance Windows are used to schedule these tasks during specific time periods, ensuring patches are applied in compliance with operational requirements. AWS Config complements this setup by providing compliance monitoring and reporting for auditing purposes. This combination ensures end-to-end automation and visibility for patch management.
- A. Correct.
Correct: Patch Manager is a feature of AWS Systems Manager that allows you to automate patching tasks by defining patch baselines and associating them with Patch Groups.
- B. Correct.
Correct: Maintenance Windows in Systems Manager allow you to schedule tasks, such as patching, during specific, predefined time slots.
- C. Incorrect.
Incorrect: Manually SSHing into EC2 instances is not scalable, does not utilize Systems Manager, and is not aligned with the goal of automation.
- D. Incorrect.
Incorrect: State Manager is used to enforce configurations but is not specifically designed for automating patching tasks.
- E. Correct.
Correct: AWS Config can be used to monitor the compliance of instances against patch baselines, providing visibility for auditing purposes.