Examkin

Question

Difficulty: MediumAWS Management, Governance, and Developer Tools

A company needs to automate the execution of patch compliance checks and run administrative shell scripts across a fleet of Amazon EC2 instances. Security policies prohibit opening inbound SSH ports or using bastion hosts. Which AWS service should the company use to securely manage these operational tasks at scale?

  1. A
    AWS CloudFormation
  2. AWS Systems ManagerAnswer
  3. C
    AWS Elastic Beanstalk
  4. D
    Amazon CloudWatch

Answer

AWS Systems Manager is the correct service for managing operational tasks, running scripts, and automating patches securely across instances without SSH access.
The correct service is AWS Systems Manager because it provides features such as Run Command and Patch Manager. These allow administrators to execute scripts, apply patches, and check compliance across a fleet of EC2 instances via the Systems Manager Agent, eliminating the need to expose inbound SSH ports or manage bastion hosts.

Step-by-Step Solution

1
Identify the primary requirement: running administrative scripts and checking patch compliance across EC2 instances without inbound SSH ports.
Requires a management service that uses an agent on the instance to pull tasks from the AWS API rather than receiving incoming network connection requests.
Security rules forbid inbound SSH, which means traditional push-based administration tools cannot be used.
2
Evaluate the management capabilities of AWS Systems Manager.
AWS Systems Manager provides Run Command and Patch Manager, which use the Systems Manager Agent (SSM Agent) to run scripts and inspect patch status over outbound HTTPS connections.
AWS Systems Manager is specifically designed for operational management, patching, and configuration of resource fleets.
3
Differentiate between the options to ensure the best fit.
AWS Systems Manager is the correct choice, while provisioning services like CloudFormation or Beanstalk, and monitoring services like CloudWatch, do not support remote script execution or patching.
Ensures the selected service aligns with operations rather than deployment or monitoring.

Key Concept

AWS Systems Manager capabilities for configuration management and operational security
Estimated Time:1m 0s
Rate this question

Topics

AWS Management, Governance, and Developer Tools

More questions from this topic