A SysOps administrator implements a new Amazon Data Lifecycle Manager (Amazon DLM) policy to create instance snapshots for Amazon EC2 instances. After the new policy runs, the SysOps administrator…

Question

Options

• AThe instances did not have the correct IAM role assigned to create the snapshots.
• BThe instances had encrypted volumes, and the DLM service role did not have the correct AWS
• CThe instances were in a different VPC from the instances that had their snapshots created. The
• DThe instances were launched after the DLM policy was implemented. The SysOps administrator

• A
  83% (33)
• B
  5% (2)
• C
  3% (1)
• D
  10% (4)

Explanation

Option A is correct because Amazon DLM instance snapshot policies (which create AMIs) can use pre/post scripts to ensure application-consistent snapshots - this requires the EC2 instances to have an IAM instance profile granting SSM permissions so DLM can communicate with the SSM Agent on the instance. Without this role, DLM cannot execute the required scripts and skips snapshot creation for those instances.

Why the distractors are wrong:

• B is incorrect because encrypted volume issues with the DLM service role would affect all encrypted instances consistently, not just two - and the question confirms tags are correct on all instances.
• C is incorrect because DLM operates at the AWS account/region level, not within VPC boundaries - VPC placement has no bearing on snapshot eligibility.
• D is incorrect because DLM dynamically discovers target instances by tags at execution time, so instances launched after policy creation are picked up automatically on the next scheduled run.

Memory tip: Think of DLM instance snapshots as needing a two-role handshake - the DLM service role (what DLM uses to act) AND the EC2 instance profile (what allows SSM/DLM to talk to the instance). If either is missing, that instance gets skipped silently.

No community discussion yet for this question.