DOP-C02 · Question #99
A company has a guideline that every Amazon EC2 instance must be launched from an AMI that the company's security team produces. Every month, the security team sends an email message with the latest…
The correct answer is C. Direct the security team to use Amazon EC2 Image Builder to create new AMIs and to place the AMI. Use SSM Parameter Store or Secret Manager as the lookup K/V store for all the related AMIs. ANother way is also for security team to constantly update and share the images cross-account and grant them KMS keys to the encrypted AMIs.
Question
A company has a guideline that every Amazon EC2 instance must be launched from an AMI that the company's security team produces. Every month, the security team sends an email message with the latest approved AMIs to all the development teams. The development teams use AWS CloudFormation to deploy their applications. When developers launch a new service, they have to search their email for the latest AMIs that the security department sent. A DevOps engineer wants to automate the process that the security team uses to provide the AMI IDs to the development teams. What is the MOST scalable solution that meets these requirements?
Options
- ADirect the security team to use CloudFormation to create new versions of the AMIs and to list the AMI
- BDirect the security team to use a CloudFormation stack to create an AWS CodePipeline pipeline that
- CDirect the security team to use Amazon EC2 Image Builder to create new AMIs and to place the AMI
- DDirect the security team to use Amazon EC2 Image Builder to create new AMIs and to create an
How the community answered
(24 responses)- A13% (3)
- B33% (8)
- C46% (11)
- D8% (2)
Explanation
Use SSM Parameter Store or Secret Manager as the lookup K/V store for all the related AMIs. ANother way is also for security team to constantly update and share the images cross-account and grant them KMS keys to the encrypted AMIs.
Topics
Community Discussion
No community discussion yet for this question.