SAP-C02 Question 429
Select 2A company is running a fleet of Amazon EC2 instances across multiple Availability Zones in a production environment. The company has a requirement to apply critical operating system (OS) patches to these instances without disrupting the ongoing application workloads. Which combination of actions should the Solutions Architect recommend to achieve this? (Select TWO.)
- A
Use AWS Systems Manager Patch Manager to automate patching of the EC2 instances.
- B
Perform in-place patching on all instances simultaneously during a scheduled maintenance window.
- C
Use an Auto Scaling group with a rolling update policy to replace unpatched instances with patched instances.
- D
Create an Amazon Machine Image (AMI) with the latest patches and perform a blue/green deployment.
- E
Manually SSH into each instance and apply the patches one by one.
Show answer and explanation
Correct answers: A, C
Explanation
The correct answers leverage AWS best practices for patching while minimizing disruption to production workloads. AWS Systems Manager Patch Manager provides an automated and scalable solution for applying patches, while an Auto Scaling group with a rolling update policy ensures that the patching process occurs incrementally without affecting application availability. These approaches align with the requirements to apply critical patches without disrupting workloads.
- A. Correct.
AWS Systems Manager Patch Manager is specifically designed to automate patching processes for EC2 instances. It enables compliance management and minimizes manual effort, making it an ideal solution for this scenario.
- B. Incorrect.
Performing in-place patching on all instances simultaneously can disrupt application workloads and introduce downtime, which conflicts with the requirement to avoid disruption.
- C. Correct.
An Auto Scaling group with a rolling update policy ensures that patched instances replace unpatched ones gradually, reducing downtime and maintaining application availability.
- D. Incorrect.
While creating an AMI and performing a blue/green deployment is a valid approach, it is not the most efficient method for fleet-wide patching in this scenario. It introduces additional complexity compared to the automated options provided by AWS Systems Manager.
- E. Incorrect.
Manually SSHing into each instance to apply patches is error-prone, time-consuming, and not scalable for a production environment. This approach does not align with best practices.