SAP-C02 Question 393
Single answerA company is managing a fleet of Amazon EC2 instances across multiple regions. They want to ensure that all instances are running the latest security patches and have a specific set of configuration changes applied. The company also requires the ability to centrally audit and track the application of these updates and configurations. Which solution should be implemented to meet these requirements?
- A
Use AWS Systems Manager State Manager to define and apply desired configurations across instances in all regions.
- B
Use AWS Systems Manager Patch Manager to apply the latest security patches, and manually configure instances for additional changes.
- C
Use AWS Config to define configuration compliance rules and apply them to all managed instances.
- D
Use AWS Elastic Beanstalk to manage the deployment and patching of EC2 instances across regions.
Show answer and explanation
Correct answer: A
Explanation
AWS Systems Manager State Manager is the ideal choice for maintaining the desired state of EC2 instances across multiple regions. It supports defining and applying configuration changes, automating patch management, and auditing changes centrally. Other options either lack the required functionality or are not suited for managing configurations and patches at scale.
- A. Correct.
This is the correct answer. AWS Systems Manager State Manager allows you to define, apply, and automatically maintain the desired state of your EC2 instances. It supports configuration changes, patching, and auditing across multiple regions.
- B. Incorrect.
This is incorrect. While AWS Systems Manager Patch Manager is useful for applying security patches, it does not handle configuration changes or provide centralized auditing of those changes.
- C. Incorrect.
This is incorrect. AWS Config is primarily used for evaluating compliance against configuration rules, not for applying or maintaining configurations.
- D. Incorrect.
This is incorrect. AWS Elastic Beanstalk is a platform-as-a-service (PaaS) solution for application deployment and does not provide the level of configuration management or patching required for this use case.