AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 15
A business needs to inventory applications operating across multiple Amazon EC2 instances. Users and roles with appropriate permissions for AWS Systems Manager have been set up by the company. An updated Systems Manager Agent version is installed and operational on every instance. While setting up an inventory collection, a SysOps administrator realizes that Systems Manager does not manage all the instances within a single subnet.
What action should the SysOps administrator take to resolve this problem?
-
A
Ensure that all the EC2 instances are configured with an instance profile with Systems Manager access.
-
B
Verify that all the EC2 instances are configured with the appropriate tags for access by Systems Manager.
-
C
Use AWS Identity and Access Management Access Analyzer to identify and automatically rectify the problem.
-
D
Configure Systems Manager to utilize an interface VPC endpoint providing access to the appropriate VPC and subnet.
Reveal correct answer
Correct answer: A
Explanation
AWS Systems Manager requires an IAM (Identity and Access Management) role for EC2 instances that it manages, to perform actions on your behalf. This IAM role is referred to as an instance profile.
If an instance is not managed by Systems Manager, one likely reason is that the instance does not have an instance profile, or the instance profile does not have the necessary permissions to allow Systems Manager to manage the instance.
Therefore, the SysOps administrator needs to ensure that all the EC2 instances have an instance profile with Systems Manager access. If an instance does not have an instance profile, or the instance profile does not have the necessary permissions, the administrator must update the instance profile to include these permissions.
CORRECT: "Ensure that all the EC2 instances are configured with an instance profile with Systems Manager access" is the correct answer (as explained above.)
INCORRECT: "Verify that all the EC2 instances are configured with the appropriate tags for access by Systems Manager" is incorrect.
Tags are used for organizing resources, not for controlling access. While they can be used in conjunction with IAM policies to allow or deny access, tags alone do not grant or deny access to Systems Manager. They are metadata to categorize your AWS resources and do not affect the operational aspects of AWS Systems Manager.
INCORRECT: "Use AWS Identity and Access Management Access Analyzer to identify and automatically rectify the problem" is incorrect.
IAM Access Analyzer is a service that helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an entity outside of your account.
While it's a helpful tool for analyzing resource permissions, it doesn't automatically remediate issues and is not specifically designed to troubleshoot Systems Manager access issues.
INCORRECT: "Configure Systems Manager to utilize an interface VPC endpoint providing access to the appropriate VPC and subnet" is incorrect.
A VPC endpoint enables private connectivity to services hosted in AWS from within your VPC and without using an internet gateway, VPN, or AWS Direct Connect connection.
While using a VPC endpoint can enhance security and possibly performance, it does not specifically impact whether an EC2 instance can be managed by Systems Manager.
The EC2 instance would still need the appropriate IAM role (instance profile) with Systems Manager permissions.
References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
