SAP-C02 Question 431
Select 3A company runs a fleet of EC2 instances that host a critical, customer-facing application. They are required to ensure that all systems remain compliant with security patching policies while minimizing downtime and operational overhead. The company wants to implement an automated patching solution that avoids reboots for non-critical updates and provides detailed compliance reports. Which combination of AWS services and practices should they use?
- A
Use AWS Systems Manager Patch Manager to automate patching and configure patch baselines.
- B
Set up AWS Systems Manager Maintenance Windows to schedule patching during off-peak hours.
- C
Enable Amazon Inspector to automatically apply patches based on findings.
- D
Use EC2 Auto Scaling to terminate and replace instances during patching.
- E
Configure Systems Manager Compliance Reporting to monitor patch compliance.
Show answer and explanation
Correct answers: A, B, E
Explanation
To automate patching while minimizing downtime, AWS Systems Manager Patch Manager should be used in combination with Maintenance Windows for scheduling. This setup avoids unnecessary reboots for non-critical updates. Additionally, Systems Manager Compliance Reporting provides the required detailed compliance reports. While Amazon Inspector and EC2 Auto Scaling have their use cases, they do not directly address the requirements of this specific scenario.
- A. Correct.
Correct. AWS Systems Manager Patch Manager is designed for automating patch management and allows custom patch baselines to define which patches are approved.
- B. Correct.
Correct. AWS Systems Manager Maintenance Windows can minimize downtime by scheduling patching activities during off-peak hours.
- C. Incorrect.
Incorrect. Amazon Inspector provides vulnerability scanning, but it does not apply patches automatically. It is not primarily a patch management service.
- D. Incorrect.
Incorrect. EC2 Auto Scaling can help maintain availability, but it is not a patching solution and may not address the need for compliance reporting or avoiding unnecessary reboots.
- E. Correct.
Correct. Systems Manager Compliance Reporting provides detailed reports on patch compliance, addressing the need for compliance monitoring.