SAP-C02 Question 430
Select 2Your organization is running a fleet of Amazon EC2 instances in multiple regions to support a global application. A recent security audit highlighted vulnerabilities in the operating systems of these instances. You need to implement a patch management solution that ensures all instances are updated with the latest security patches while minimizing downtime. Which of the following approaches should you implement?
- A
Use AWS Systems Manager Patch Manager to automate patching of EC2 instances during specified maintenance windows.
- B
Create an Auto Scaling group for the instances, update the launch template with the patched AMI, and perform a rolling update.
- C
Manually connect to each EC2 instance via SSH and apply patches by running update commands.
- D
Use AWS OpsWorks to automatically apply patches to all instances without restarting them.
- E
Leverage AWS Inspector to apply patches directly to the EC2 instances.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure consistent and automated patch management for EC2 instances, AWS Systems Manager Patch Manager is the most efficient and scalable solution. It allows you to define patch baselines and automate the process within maintenance windows. Additionally, using an Auto Scaling group with a patched AMI and performing a rolling update ensures that new instances are launched with the latest patches while maintaining application availability. These approaches align with best practices for patching in AWS environments.
- A. Correct.
Correct. AWS Systems Manager Patch Manager allows you to automate the patching process on EC2 instances across multiple regions. You can define patch baselines, specify maintenance windows, and ensure compliance with security policies.
- B. Correct.
Correct. Updating the launch template with a patched AMI and performing a rolling update ensures that new instances are launched with the latest patches while minimizing downtime for the application.
- C. Incorrect.
Incorrect. Manual patching is time-consuming, error-prone, and does not scale well for large fleets of instances. It also lacks automation and compliance tracking.
- D. Incorrect.
Incorrect. While AWS OpsWorks can manage configuration and deployment, it is not designed specifically for patch management. Furthermore, patching often requires instance restart, which OpsWorks does not handle automatically.
- E. Incorrect.
Incorrect. AWS Inspector is a vulnerability assessment service that identifies issues but does not directly apply patches to EC2 instances.