SAP-C02 · Question #613
A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years. The company's business has grown rapidly in…
The correct answer is C. Create an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to D. Create automation scripts to patch an AMI, update the launch configuration, and invoke an Auto. To prevent an Auto Scaling group from replacing patched instances with unpatched ones after a reboot for security updates, automate the process of creating patched AMIs, updating the ASG's launch configuration, and using instance refresh, while also managing existing instances…
Question
A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years. The company's business has grown rapidly in the past few months. In response, the company's operations team has implemented an Auto Scaling group to manage the sudden increases in traffic. Company policy requires a monthly installation of security updates on all operating systems that are running. The most recent security update required a reboot. As a result, the Auto Scaling group terminated the instances and replaced them with new, unpatched instances. Which combination of steps should a solutions architect recommend to avoid a recurrence of this issue? (Choose two.)
Options
- AModify the Auto Scaling group by setting the Update policy to target the oldest launch
- BCreate a new Auto Scaling group before the next patch maintenance. During the maintenance
- CCreate an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to
- DCreate automation scripts to patch an AMI, update the launch configuration, and invoke an Auto
- ECreate an Elastic Load Balancer in front of the Auto Scaling group. Configure termination
How the community answered
(43 responses)- A12% (5)
- B7% (3)
- C58% (25)
- E23% (10)
Why each option
To prevent an Auto Scaling group from replacing patched instances with unpatched ones after a reboot for security updates, automate the process of creating patched AMIs, updating the ASG's launch configuration, and using instance refresh, while also managing existing instances during in-place patching.
Modifying the Auto Scaling group's Update policy to target the oldest launch configuration doesn't solve the core problem of the ASG replacing instances with unpatched ones; it only dictates which instances are updated, not the source AMI.
Creating a new Auto Scaling group and manually switching during maintenance is a valid deployment strategy but is higher operational effort than automating AMI updates and instance refresh, and doesn't inherently prevent the new ASG from launching unpatched instances if its launch configuration isn't updated.
Configuring monitoring to detect an instance requiring patching and setting it to Standby mode allows it to be temporarily removed from the load balancer and patched in-place without the Auto Scaling group prematurely terminating it due to perceived unhealthiness during the reboot.
Creating automation scripts to patch an AMI, update the Auto Scaling group's launch configuration to use the new AMI, and then invoking an instance refresh is the canonical method to gracefully replace all instances with updated, patched versions, ensuring new instances are always patched.
Configuring an Elastic Load Balancer (ELB) in front of the ASG is standard, but configuring termination protection on instances is generally avoided with ASG as it interferes with the group's ability to manage its fleet and auto-heal.
Concept tested: Auto Scaling group updates, instance refresh, AMI patching, graceful maintenance
Source: https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html
Community Discussion
No community discussion yet for this question.