AWS Certified Devops Engineer Professional · Free Practice Question Medium
Question 15
A company runs many different workloads across hundreds of Amazon EC2 instances. The DevOps team requires that all instances have standard configurations. These configurations include standard logging, metrics, security assessments, and weekly patching.
Which combination of actions meets these requirements with the most operational efficiency? (Select TWO.)
-
A
Use AWS Systems Manager to install and manage Amazon Inspector, Systems Manager Patch Manager, and the Amazon CloudWatch agent on all instances.
-
B
Use AWS OpsWorks and execute custom recipes to patch the EC2 instances. Use AWS Systems Manager Run Command to initiate regular Amazon Inspector assessment runs.
-
C
Use AWS Systems Manager maintenance windows with Systems Manager Run Command to schedule Systems Manager Patch Manager tasks. Use Amazon EventBridge to schedule Amazon Inspector assessment runs.
-
D
Use Amazon Inspector to install and manage AWS Systems Manager, AWS OpsWorks, and the Amazon CloudWatch agent on all instances.
-
E
Use AWS CloudFormation with change sets to deploy AMIs patched by Systems Manager Patch Manager to existing EC2 instances. Use AWS Config to require regular Amazon Inspector assessment runs.
Reveal correct answers
Correct answers: A, C
Explanation
The most operationally efficient solution is to use AWS Systems Manager patch manager for patching and Amazon Inspector for assessing the security status of the instances. The Amazon CloudWatch agent can also be installed on the instances to get enhanced metrics and logging.
Systems Manager can be used to install and manage the other components. You must have the Systems Manager agent installed on the instances and the instance profile attached must have permissions to Systems Manager.
The patching process can be implemented by using Systems Manager Run Command to schedule tasks that deploy the updates using Systems Manager Patch Manager. EventBridge is ideal for scheduling the Amazon Inspector assessment runs.
CORRECT: "Use AWS Systems Manager to install and manage Amazon Inspector, Systems Manager Patch Manager, and the Amazon CloudWatch agent on all instances" is a correct answer (as explained above.)
CORRECT: "Use AWS Systems Manager maintenance windows with Systems Manager Run Command to schedule Systems Manager Patch Manager tasks. Use Amazon EventBridge to schedule Amazon Inspector assessment runs" is also a correct answer (as explained above.)
INCORRECT: "Use Amazon Inspector to install and manage AWS Systems Manager, AWS OpsWorks, and the Amazon CloudWatch agent on all instances" is incorrect.
Inspector is not a service that can be used to install anything, it simply runs assessments against your instances and lets you know if there are any security concerns.
INCORRECT: "Use AWS OpsWorks and execute custom recipes to patch the EC2 instances. Use AWS Systems Manager Run Command to initiate regular Amazon Inspector assessment runs" is incorrect.
OpsWorks would be less operationally efficient for this purpose. Systems Manager Patch Manager is a better way to deploy patches as it is designed for this purpose and provides many features to simplify and optimize the patching process.
INCORRECT: "Use AWS CloudFormation with change sets to deploy AMIs patched by Systems Manager Patch Manager to existing EC2 instances. Use AWS Config to require regular Amazon Inspector assessment runs" is incorrect.
You cannot deploy patched AMIs to existing instances. AMIs are used to deploy the instance initially but you cannot redeploy the AMI without wiping the instance state. Config also cannot be used to enforce an Amazon Inspector assessment run.
References:
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html
https://aws.amazon.com/inspector/
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
