SCS-C02 Question 242
Select 3Your organization is using Amazon EC2 instances to host a critical application. To ensure security and compliance standards are met, you need to automate the process of patching operating systems, creating backups, and maintaining up-to-date, secure AMIs. Which combination of AWS services and approaches will best help you achieve these goals?
- A
Use Systems Manager Patch Manager to automate patching of the EC2 instances.
- B
Use AWS Backup to create and manage snapshots of the EC2 volumes.
- C
Use EC2 Image Builder to automate the creation and maintenance of secure AMIs.
- D
Manually log in to each EC2 instance to apply patches and create manual AMIs.
- E
Use AWS Config to evaluate compliance of the EC2 instances and trigger patching workflows.
Show answer and explanation
Correct answers: A, B, C
Explanation
To securely maintain EC2 instances in compliance with organizational standards, it is essential to automate repetitive tasks like patching, snapshot management, and AMI creation. Systems Manager Patch Manager, AWS Backup, and EC2 Image Builder are purpose-built tools that provide automation, reduce human error, and ensure consistency. Manual processes and tools like AWS Config, while useful in specific scenarios, do not provide the necessary automation for these tasks.
- A. Correct.
Correct: Systems Manager Patch Manager allows you to automate the patching process for operating systems on EC2 instances, ensuring they remain secure and compliant.
- B. Correct.
Correct: AWS Backup provides a centralized way to create and manage snapshots of EC2 volumes, ensuring data durability and recovery.
- C. Correct.
Correct: EC2 Image Builder enables you to automate the process of building, testing, and distributing secure AMIs, ensuring that your instances are launched from up-to-date and compliant images.
- D. Incorrect.
Incorrect: Manually logging into instances to apply patches and create AMIs is error-prone, inefficient, and does not align with best practices for automation and security.
- E. Incorrect.
Incorrect: While AWS Config can evaluate compliance, it does not directly automate patching or AMI creation. It is better used as a monitoring and compliance tool rather than as a mechanism for maintenance tasks.