SAP-C02 Question 394
Select 3A company wants to automate the patch management process across its fleet of Amazon EC2 instances spread across multiple AWS Regions. They also need to ensure compliance with security policies by running scripts to validate configuration changes after patches are applied. Which combination of AWS Systems Manager features should be used to meet these requirements?
- A
AWS Systems Manager Patch Manager
- B
AWS Systems Manager State Manager
- C
AWS Systems Manager Automation
- D
AWS Systems Manager Run Command
- E
AWS Systems Manager Compliance
Show answer and explanation
Correct answers: A, C, D
Explanation
To automate patch management across EC2 instances, AWS Systems Manager Patch Manager is the most appropriate choice. After patches are applied, AWS Systems Manager Automation can be used to execute runbooks or workflows for validating configuration changes. Additionally, AWS Systems Manager Run Command can run ad-hoc scripts to check or enforce compliance with configuration requirements. State Manager and Compliance are not directly involved in this scenario.
- A. Correct.
AWS Systems Manager Patch Manager is the primary tool for automating patch management across EC2 instances. It allows you to define patch baselines and apply patches automatically.
- B. Incorrect.
AWS Systems Manager State Manager is used to enforce configuration states on instances, but it is not specifically designed for patch management or running custom validation scripts after patches are applied.
- C. Correct.
AWS Systems Manager Automation enables the execution of runbooks and workflows, which can include custom scripts to validate configuration changes after patches are applied.
- D. Correct.
AWS Systems Manager Run Command is suitable for running ad-hoc commands or scripts, making it useful for validating configurations after patches are applied.
- E. Incorrect.
AWS Systems Manager Compliance is used to track and report compliance status but does not directly automate patch management or run scripts.