Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A SysOps Administrator is tasked with automating the deployment of OS patches for a fleet of Amazon Linux 2023 EC2 instances. The administrator wants to use a custom patch baseline to enforce security compliance. The instances are divided into a 'Production' environment, and patches must only be applied during a weekly Saturday night maintenance window. The setup must ensure that the custom baseline is applied rather than the default AWS-managed baseline. Arrange the steps in the correct order to configure this automated patch management workflow.

  1. 1Create a custom patch baseline for Amazon Linux 2023 and define the required patch approval rules.
  2. 2Associate the patch group named 'Production' with the newly created custom patch baseline in the Systems Manager console.
  3. 3Apply the case-sensitive tag key 'Patch Group' with the value 'Production' to the EC2 instances.
  4. 4Create a Systems Manager Maintenance Window that defines the weekly Saturday night schedule.
  5. 5Register the EC2 instances as targets and assign the 'AWS-RunPatchBaseline' task to the Maintenance Window.

Answer

The correct order of steps is: 1) Create a custom patch baseline for Amazon Linux 2023. 2) Associate the patch group named 'Production' with the custom patch baseline. 3) Apply the case-sensitive tag key 'Patch Group' with value 'Production' to the EC2 instances. 4) Create a Systems Manager Maintenance Window. 5) Register targets and the AWS-RunPatchBaseline task to the Maintenance Window.
The correct order follows the logical dependencies of Systems Manager resources. First, the custom patch baseline is created to define rules. Second, the patch group name is associated with the baseline so that when instances register to the group, Systems Manager knows which baseline to apply. Third, the 'Patch Group' tag is applied to instances. Fourth, a Maintenance Window is defined to control the schedule. Finally, targets and the 'AWS-RunPatchBaseline' task are registered within the Maintenance Window.

Step-by-Step Solution

1
Create the custom patch baseline.
A custom baseline with custom approval rules is created.
This establishes the compliance rules for Amazon Linux 2023 before any association can occur.
2
Associate the 'Production' patch group string with the custom patch baseline.
The patch group is bound to the custom baseline.
This ensures any instance belonging to the 'Production' patch group uses the custom baseline rather than the default baseline.
3
Tag the EC2 instances with the case-sensitive tag key 'Patch Group' and value 'Production'.
The instances are grouped under the 'Production' patch group.
This assigns the instances to the correct baseline and allows them to be targeted together.
4
Create a Systems Manager Maintenance Window.
A scheduled window is defined.
A Maintenance Window must exist before targets and tasks can be registered under it.
5
Register the target instances and the 'AWS-RunPatchBaseline' task in the Maintenance Window.
The automated patching workflow is fully configured.
This links the schedule, the target instances, and the patching command to execute the updates.

Key Concept

Orchestrating automated patching using Systems Manager Patch Manager custom baselines, patch groups, and maintenance windows.
Estimated Time:2m 0s
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic