SOA-C02 Question 158
Single answerYou are managing an Amazon EC2 fleet in a production environment. To ensure compliance and security, you need to automate the installation of critical patches across your instances. Which AWS service and configuration combination should you use to achieve this?
- A
AWS Systems Manager Patch Manager with a predefined patch baseline
- B
AWS Config with a custom compliance rule
- C
Amazon Inspector for automated patch deployment
- D
AWS Auto Scaling with a new launch configuration for patched instances
Show answer and explanation
Correct answer: A
Explanation
AWS Systems Manager Patch Manager is the appropriate service for automating patch management on EC2 instances. It allows you to define patch baselines, automate patching schedules, and ensure compliance across your environment. Other options, such as AWS Config and Amazon Inspector, are complementary but do not directly provide automated patch installation functionality.
- A. Correct.
AWS Systems Manager Patch Manager is a service specifically designed to automate patch management tasks, including selecting a patch baseline, scheduling patch installations, and applying patches to managed instances. This is the correct solution for automating patch management.
- B. Incorrect.
AWS Config is used for monitoring and compliance but does not directly automate patch installation. It can be used to check if certain configurations or patches are compliant, but it does not apply patches.
- C. Incorrect.
Amazon Inspector is used for vulnerability scanning and security assessments but does not handle automatic patch deployment. It identifies issues but does not remediate them by itself.
- D. Incorrect.
AWS Auto Scaling can replace instances with new ones using a launch configuration, but it is not a patch management solution. This approach is not relevant to automating patch installations for existing instances.