Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A SysOps Administrator is tasked with automating security updates for a fleet of production Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The updates must be applied during a weekly maintenance window using a custom patch baseline. The administrator wants to use a patch group named 'Production-RHEL' to map these instances to the baseline. Arrange the steps in the correct chronological order to configure this automated patch management workflow.

  1. 1Create a custom patch baseline in AWS Systems Manager Patch Manager and define the approval rules for RHEL patches.
  2. 2Associate the patch group name 'Production-RHEL' with the custom patch baseline in Patch Manager.
  3. 3Tag the target RHEL EC2 instances with the case-sensitive key 'Patch Group' and value 'Production-RHEL'.
  4. 4Create a Systems Manager Maintenance Window and register the target instances using the 'Patch Group' tag as the selection criteria.
  5. 5Register a task within the Maintenance Window using the 'AWS-RunPatchBaseline' document with the operation set to 'Install'.

Answer

To configure automated patching, first create the custom patch baseline. Next, associate the patch group 'Production-RHEL' with the baseline. Then, tag the RHEL EC2 instances with the case-sensitive key 'Patch Group' and value 'Production-RHEL' to map them to the baseline. Afterward, create a Systems Manager Maintenance Window and register the target instances. Finally, register the 'AWS-RunPatchBaseline' task under the Maintenance Window with the 'Install' operation.
The correct order begins with creating the custom baseline to define patch rules, followed by associating the patch group 'Production-RHEL' with it. Instances must then be tagged with the case-sensitive key 'Patch Group' to associate them with the patch group and custom baseline. Next, the Maintenance Window is created, and targets are registered. Finally, the task is registered to run the 'AWS-RunPatchBaseline' document against these targets.

Step-by-Step Solution

1
Create the custom patch baseline.
A patch baseline is established with custom approval rules for RHEL.
You must have a baseline defined first to establish the patching rules.
2
Associate the patch group with the baseline.
The patch group name 'Production-RHEL' is registered to the custom baseline.
This links the patch group to the custom rules instead of the default baseline.
3
Tag the EC2 instances.
Instances are assigned the tag Key 'Patch Group' and Value 'Production-RHEL'.
Systems Manager uses this specific case-sensitive tag to resolve which baseline to apply to each instance.
4
Create a Maintenance Window and register targets.
A scheduled maintenance window is created with targets selected by the 'Patch Group' tag.
This establishes the timeline and groups the resources that will undergo patching.
5
Register the task in the Maintenance Window.
The 'AWS-RunPatchBaseline' task is registered with the 'Install' operation.
This orchestrates the actual patch execution during the scheduled window.

Key Concept

Configuring AWS Systems Manager Patch Manager and Maintenance Windows requires a precise sequence where baselines are created and associated with patch groups, target instances are tagged with the case-sensitive 'Patch Group' key, and then a maintenance window orchestrates the 'AWS-RunPatchBaseline' task execution.
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic