SOA-C02 Question 160
Select 3Your organization wants to ensure that all EC2 instances in your environment are automatically patched with the latest security updates. You have been asked to implement a solution that minimizes manual intervention while following AWS best practices. Which combination of steps should you take to achieve this?
- A
Use AWS Systems Manager Patch Manager to define patch baselines and automate patching tasks.
- B
Manually log in to each EC2 instance and run the necessary updates.
- C
Attach the appropriate IAM role with Systems Manager permissions to the EC2 instances.
- D
Create a maintenance window in AWS Systems Manager to schedule patching operations.
- E
Enable automated patching in the EC2 console for each instance.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement automated patch management in AWS, you should use AWS Systems Manager Patch Manager to define patch baselines and automate the patching process. The EC2 instances must have the appropriate IAM role with Systems Manager access permissions, and you should schedule the patching operations by creating maintenance windows in Systems Manager. This approach minimizes manual intervention and aligns with AWS best practices for automation and security.
- A. Correct.
Correct: AWS Systems Manager Patch Manager is a service designed to automate the process of patching managed instances. It allows you to define patch baselines and automate the application of patches.
- B. Incorrect.
Incorrect: Manually logging in to each instance is not only inefficient but also contrary to AWS best practices, which recommend automation for scalability and reliability.
- C. Correct.
Correct: For Systems Manager to manage EC2 instances, the appropriate IAM role with necessary permissions must be attached to the instances. This allows Systems Manager to communicate with the instances.
- D. Correct.
Correct: A maintenance window in Systems Manager helps you define the schedule for patching operations, ensuring that patches are applied during defined timeframes.
- E. Incorrect.
Incorrect: There is no option in the EC2 console to enable automated patching. Patch management for EC2 instances is typically handled through AWS Systems Manager Patch Manager.