SCS-C02 Question 243
Single answerAn organization uses EC2 instances to host critical applications. As part of their security and compliance requirements, they must ensure that all instances are patched regularly, that images are securely maintained, and that any changes are tracked. What is the MOST effective way to automate the provisioning and maintenance of these EC2 instances while meeting the security requirements?
- A
Manually log into each EC2 instance to apply patches and create snapshots periodically.
- B
Use AWS Systems Manager to automate patching and combine it with EC2 Image Builder to create and maintain secure AMIs.
- C
Deploy an Auto Scaling group with a lifecycle hook to apply patches and create snapshots during instance creation.
- D
Write custom scripts to inspect instances for compliance and execute them on a schedule using cron jobs.
Show answer and explanation
Correct answer: B
Explanation
Using AWS Systems Manager and EC2 Image Builder together is the most effective and secure solution for automating the provisioning and maintenance of EC2 instances. Systems Manager automates patching tasks, while EC2 Image Builder ensures AMIs are securely created and maintained. This combination provides scalability, compliance tracking, and reduces management overhead compared to manual processes or custom scripts.
- A. Incorrect.
Manually logging into each instance is a time-consuming and error-prone process that does not scale well or meet compliance requirements effectively. It also lacks automation and tracking.
- B. Correct.
AWS Systems Manager provides automation for patching, while EC2 Image Builder allows for secure AMI creation and maintenance. This approach is efficient, scalable, and tracks changes, meeting compliance requirements.
- C. Incorrect.
While Auto Scaling groups can manage instance scaling, using lifecycle hooks for patching and snapshots is not the most efficient or secure approach for ongoing maintenance of instances.
- D. Incorrect.
Custom scripts with cron jobs can be used to automate certain tasks but require significant management overhead and do not inherently provide compliance tracking or secure AMI creation.