Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A SysOps Administrator is responsible for managing the OS updates for a fleet of Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The fleet consists of two environments: development and production. The administrator needs to automate the patching process using AWS Systems Manager Patch Manager so that development instances are patched using a custom baseline named RHEL-Dev-Baseline, and production instances are patched using a custom baseline named RHEL-Prod-Baseline. Patches must be applied automatically during separate weekly maintenance windows. Which two actions must the SysOps Administrator perform to ensure the correct baseline is applied to each environment during their scheduled maintenance windows? (Select TWO.)

  1. Apply a tag to the EC2 instances with the key 'Patch Group' and set the value to 'Dev-Patch-Group' for development instances and 'Prod-Patch-Group' for production instances.Answer
  2. In Systems Manager Patch Manager, associate the RHEL-Dev-Baseline with the Dev-Patch-Group patch group, and the RHEL-Prod-Baseline with the Prod-Patch-Group patch group.Answer
  3. C
    Apply a tag to the EC2 instances with the key 'patch-group' and set the value to 'Dev-Patch-Group' for development instances and 'Prod-Patch-Group' for production instances.
  4. D
    Set both RHEL-Dev-Baseline and RHEL-Prod-Baseline as the default patch baselines in the Systems Manager Patch Manager console.
  5. E
    Configure the Maintenance Window task with a service role that has sts:AssumeRole permissions, without granting iam:PassRole permissions to the IAM identity registering the task.

Answer

Apply a tag to the EC2 instances with the key 'Patch Group' and set the value to 'Dev-Patch-Group' for development instances and 'Prod-Patch-Group' for production instances. In Systems Manager Patch Manager, associate the RHEL-Dev-Baseline with the Dev-Patch-Group patch group, and the RHEL-Prod-Baseline with the Prod-Patch-Group patch group.
To apply custom baselines to specific EC2 instances, the instances must be grouped into patch groups by applying a resource tag with the key 'Patch Group'. Then, the custom patch baselines must be explicitly associated with these patch groups in Systems Manager Patch Manager. When the maintenance window task runs the patching document, Systems Manager checks the 'Patch Group' tag of the target instances, identifies the associated baseline, and applies the updates accordingly.

Step-by-Step Solution

1
Tag the target EC2 instances with the system-defined tag key 'Patch Group' using values matching the development and production groups.
Instances are logical members of their respective patch groups.
Systems Manager uses this specific tag key to assign instances to patch groups.
2
Associate each custom patch baseline with its corresponding patch group in the Systems Manager console or using the AWS CLI register-patch-baseline-for-patch-group command.
Custom patch baselines are mapped to Dev-Patch-Group and Prod-Patch-Group.
This configuration overrides the region-wide default patch baseline for these specific groups.
3
Register Maintenance Window tasks targeting the patch groups and ensure the registering user has the necessary iam:PassRole permissions for the service role.
The automated maintenance window execution succeeds and applies the correct baseline to each environment.
The iam:PassRole permission allows Systems Manager to run the patch task on behalf of the administrator using the specified service role.

Key Concept

Systems Manager Patch Manager uses the case-sensitive tag key 'Patch Group' to map instances to patch groups, which are then associated with custom patch baselines. The execution of these automated updates requires proper iam:PassRole authorization for Maintenance Window tasks.
Estimated Time:1m 30s
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic