SCS-C02 Question 240
Single answerYou are a security engineer tasked with ensuring that all Amazon EC2 instances in your environment are kept up-to-date with the latest security patches. You also need to minimize manual intervention and ensure that proper compliance reports are generated to track patching activities. Which approach should you take to meet these requirements?
- A
Use AWS Systems Manager Patch Manager to automate the patching process for EC2 instances and enable compliance reporting.
- B
Manually log in to each EC2 instance regularly and apply patches using the operating system's package manager.
- C
Create custom AMIs with pre-applied patches and replace the EC2 instances with these AMIs whenever new patches are available.
- D
Use EC2 Image Builder to automate the creation of patched AMIs and redeploy the instances manually using those AMIs.
Show answer and explanation
Correct answer: A
Explanation
AWS Systems Manager Patch Manager is specifically designed to automate the patching of operating systems and applications on Amazon EC2 instances. It also provides compliance reporting, which helps track the patching activities and ensures compliance with security requirements. This approach minimizes manual intervention and meets the requirements stated in the scenario.
- A. Correct.
This is the correct answer. AWS Systems Manager Patch Manager provides an automated, scalable, and auditable solution for patching EC2 instances. It also includes compliance reporting to track the patch status of your instances.
- B. Incorrect.
This is not a scalable or efficient solution, and it increases the risk of human error. Additionally, compliance reporting would have to be done manually, making it harder to track patching activities.
- C. Incorrect.
While custom AMIs can be used for patching, this approach is not efficient for continuous patch management. It also introduces the challenge of managing instance replacements and does not provide automated compliance reporting.
- D. Incorrect.
Using EC2 Image Builder can help automate AMI creation with patches, but it does not directly address the requirement for automating patching on running instances or providing compliance reports. It is more suited for scenarios where immutable infrastructure is required.