SAP-C02 Question 432
Select 2A financial services company uses Amazon EC2 instances to host its critical applications. These instances are distributed across multiple AWS regions and run various operating systems. The company needs to ensure that all instances are patched regularly to meet regulatory compliance requirements. Which combination of approaches would provide a scalable and automated solution for patching while minimizing operational overhead?
- A
Use AWS Systems Manager Patch Manager to automate patching for EC2 instances and define patch baselines.
- B
Manually log in to each EC2 instance across regions and apply patches as needed.
- C
Use AWS Systems Manager State Manager to enforce compliance by applying the latest patches based on a defined schedule.
- D
Enable AWS Trusted Advisor to identify unpatched instances and use Amazon CloudWatch to automate remediation.
- E
Create custom scripts to apply patches and schedule them using cron jobs on individual EC2 instances.
Show answer and explanation
Correct answers: A, C
Explanation
Automating patch management is critical for maintaining compliance and minimizing operational overhead in large-scale environments. AWS Systems Manager Patch Manager allows you to automate the patching process across EC2 instances by defining patch baselines and schedules, while State Manager enforces compliance by ensuring instances stay patched over time. These approaches provide a scalable, reliable, and automated solution compared to manual or custom-scripted methods.
- A. Correct.
This is correct. AWS Systems Manager Patch Manager is designed to automate patching tasks at scale, allowing you to define patch baselines, scan instances for missing patches, and apply patches automatically.
- B. Incorrect.
This is incorrect. Manually logging in to each instance is highly inefficient, error-prone, and not scalable, particularly in a multi-region environment.
- C. Correct.
This is correct. AWS Systems Manager State Manager can enforce patch compliance by associating patch baselines and applying them on a defined schedule, ensuring instances remain compliant automatically.
- D. Incorrect.
This is incorrect. While AWS Trusted Advisor can identify unpatched instances, it does not provide automated patching capabilities or integration with CloudWatch for remediation.
- E. Incorrect.
This is incorrect. Writing custom scripts and scheduling them manually introduces significant operational overhead and lacks the scalability and automation provided by AWS Systems Manager services.