Examkin

Question

Difficulty: EasyPatch Management and OS Compliance Automation

A SysOps Administrator is setting up AWS Systems Manager Patch Manager to automate operating system updates for a fleet of Amazon Linux 2 instances. The administrator has created a custom patch baseline for development environments. However, during testing, the administrator notices that the development instances are still being patched using the default AWS-managed patch baseline instead of the custom one. Which action must the administrator take to ensure the development instances are associated with the custom patch baseline?

  1. Apply a tag to the development instances with the key 'Patch Group' and a custom group value, then register this patch group with the custom patch baseline.Answer
  2. B
    Apply a tag to the development instances with the key 'patch-group' and a custom group value, then register this patch group with the custom patch baseline.
  3. C
    Apply a tag to the development instances with the key 'PatchBaseline' and the ARN of the custom patch baseline as the value.
  4. D
    Configure an IAM instance profile on the development instances that includes the iam:PassRole permission allowed for the custom patch baseline.

Answer

Apply a tag to the development instances with the key 'Patch Group' and a custom group value, then register this patch group with the custom patch baseline.
The correct action is to apply a tag to the development instances using the key 'Patch Group' and the designated group name as the value, and then register that patch group name with the custom patch baseline. Patch Manager automatically evaluates this tag to redirect the instances from the default baseline to the custom baseline.

Step-by-Step Solution

1
Create a custom patch baseline in AWS Systems Manager Patch Manager and specify the patch rules.
A custom patch baseline exists but is not yet associated with any specific instances.
Before mapping instances, the baseline must be defined.
2
Register a patch group name with the custom patch baseline.
The baseline is configured to apply to any instances that belong to the registered patch group.
This establishes the logical link between the baseline and a group identifier.
3
Apply a resource tag to the target EC2 instances using the case-sensitive key 'Patch Group' and the registered patch group name as the value.
Systems Manager Patch Manager detects the tag and routes the instances to use the custom patch baseline instead of the default baseline.
AWS Systems Manager uses the exact tag key 'Patch Group' to associate managed nodes with patch baselines.

Key Concept

AWS Systems Manager Patch Manager uses the case-sensitive tag key 'Patch Group' to map managed instances to custom patch baselines.
Estimated Time:1m 0s
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic