Examkin

Question

Difficulty: HardAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is configuring automated monthly patching for a fleet of Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The administrator creates a custom patch baseline named RHEL-Critical-Baseline to approve only critical security updates. The target EC2 instances are tagged with the tag key Patch Group and the value RHEL-Production. The SSM Agent is running on all target instances, and an IAM instance profile with the AmazonSSMManagedInstanceCore policy is attached to all of them. The administrator then configures a Systems Manager State Manager association to run the AWS-RunPatchBaseline document on the instances tagged with Patch Group: RHEL-Production. During execution, the administrator observes that the instances are being patched, but they are receiving all updates from the default AWS-provided RHEL patch baseline rather than the custom RHEL-Critical-Baseline. Which action will resolve this issue?

  1. Register the RHEL-Production patch group with the RHEL-Critical-Baseline custom patch baseline.Answer
  2. B
    Modify the State Manager association parameters to pass the custom baseline name RHEL-Critical-Baseline directly into the AWS-RunPatchBaseline document.
  3. C
    Configure an IAM policy for the EC2 instances' instance profile that includes iam:PassRole permissions for the custom patch baseline ARN.
  4. D
    Update the VPC route table associated with the private subnets hosting the instances to add a route to the local internet gateway (IGW) for SSM endpoint communication.

Answer

Register the RHEL-Production patch group with the RHEL-Critical-Baseline custom patch baseline.
To apply a custom patch baseline, the associated patch group must be explicitly registered with it. If a patch group is not registered with any custom baseline, AWS Systems Manager Patch Manager automatically applies the default baseline for that operating system. Registering the RHEL-Production patch group with the RHEL-Critical-Baseline custom patch baseline ensures that instances in that patch group are evaluated against the custom baseline.

Step-by-Step Solution

1
Inspect the managed nodes configuration and confirm that the target instances are successfully tagged with the Patch Group tag.
Confirming that the instances have Patch Group = RHEL-Production.
This confirms that Systems Manager can read the correct patch group metadata from the target nodes.
2
Verify if the patch group RHEL-Production has been registered to the custom patch baseline RHEL-Critical-Baseline in Patch Manager.
Identify that the patch group has not been registered to the custom baseline, causing Patch Manager to default to the AWS-provided default RHEL baseline.
By default, Patch Manager evaluates managed nodes against the default patch baseline unless their patch group is registered to a custom baseline.
3
Navigate to Systems Manager Patch Manager, select the RHEL-Critical-Baseline, and register the RHEL-Production patch group to it.
The association between the patch group and the custom patch baseline is established.
This registration overrides the default baseline behavior, ensuring the custom baseline is applied to all instances in this patch group during the next association run.

Key Concept

AWS Systems Manager Patch Groups and Baselines registration
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation