Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A company manages a fleet of Amazon EC2 instances running SUSE Linux Enterprise Server (SLES) split into Development and Production environments. A SysOps Administrator creates a custom patch baseline for SLES and registers a patch group named 'SLES-Dev' to this baseline. The administrator tags the Development EC2 instances with a tag key of 'Patch_Group' and a value of 'SLES-Dev'. A Systems Manager Maintenance Window is configured to run patch operations targeting these instances. During the next scheduled maintenance window, the administrator notices that the Development instances are patched using the default AWS-managed SLES patch baseline instead of the custom patch baseline. Which of the following explains why the Development instances were patched using the default baseline?

  1. The tag key on the EC2 instances must be defined as 'Patch Group' instead of 'Patch_Group'.Answer
  2. B
    The IAM role associated with the Systems Manager Maintenance Window is missing the iam:PassRole permission to execute the patching task.
  3. C
    The custom patch baseline has not been set as the default baseline for SLES in Systems Manager Patch Manager.
  4. D
    The Development instances must be registered to the patch group using the Systems Manager API, as tags are only used for resource grouping.

Answer

The tag key on the EC2 instances must be defined as 'Patch Group' instead of 'Patch_Group'.
Systems Manager Patch Manager relies on a specific tag key named 'Patch Group' (case-sensitive, containing a space) to map EC2 instances to defined patch groups. Because the administrator used 'Patch_Group' (with an underscore), Patch Manager failed to recognize the mapping. Consequently, the instances were not associated with the 'SLES-Dev' patch group, causing Patch Manager to fall back to the default AWS-managed patch baseline for SLES.

Step-by-Step Solution

1
Identify the mechanism Systems Manager Patch Manager uses to associate EC2 instances with patch groups.
Patch Manager checks for the Amazon EC2 resource tag key 'Patch Group' (case-sensitive and containing a space).
This specific key is required by AWS Systems Manager to parse patch group associations.
2
Analyze the tag configuration applied to the Development instances.
The instances were tagged with 'Patch_Group' (using an underscore).
To evaluate if the configuration matches the Systems Manager requirement.
3
Determine the consequence of the mismatched tag key.
Patch Manager fails to map the instances to the 'SLES-Dev' patch group and falls back to using the default patch baseline.
When no patch group is recognized, Systems Manager defaults to the default baseline defined for that operating system.

Key Concept

Systems Manager Patch Group Tagging Requirements
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic