SOA-C03 · Question #89
A company has deployed Amazon EC2 instances from custom Amazon Machine Images (AMIs) in two AWS Regions. The company registered all the instances with AWS Systems Manager. The company discovers that…
The correct answer is A. Define a patch baseline in Systems Manager Patch Manager. Use a Patch Manager scan to. AWS Systems Manager Patch Manager is designed specifically to scan managed instances for missing patches and apply them with minimal operational effort. By defining a patch baseline and running a Patch Manager scan, you can automatically identify which instances are vulnerable…
Question
A company has deployed Amazon EC2 instances from custom Amazon Machine Images (AMIs) in two AWS Regions. The company registered all the instances with AWS Systems Manager. The company discovers that the operating system on some instances has a significant zero-day exploit. However, the company does not know how many instances are affected. A CloudOps engineer must implement a solution to deploy operating system patches for the affected EC2 instances. Which solution will meet this requirement with the LEAST operational overhead?
Options
- ADefine a patch baseline in Systems Manager Patch Manager. Use a Patch Manager scan to
- BUse AWS Config to identify the affected instances. Define a patch baseline in Systems Manager
- CCreate an Amazon EventBridge rule to react to Systems Manager Compliance events. Configure
- DUse AWS Config to identify the affected instances. Update the existing EC2 AMIs with the desired
How the community answered
(51 responses)- A73% (37)
- B4% (2)
- C10% (5)
- D14% (7)
Explanation
AWS Systems Manager Patch Manager is designed specifically to scan managed instances for missing patches and apply them with minimal operational effort. By defining a patch baseline and running a Patch Manager scan, you can automatically identify which instances are vulnerable, then use Patch Now (per Region) to patch only the affected instances. This leverages existing SSM integration, avoids extra services like AWS Config or manual AMI/instance management, and provides the lowest operational overhead.
Topics
Community Discussion
No community discussion yet for this question.