Examkin

Question

Difficulty: EasyPatch Management and OS Compliance Automation

A SysOps Administrator is using AWS Systems Manager Patch Manager to automate security updates for a fleet of Red Hat Enterprise Linux (RHEL) EC2 instances. The administrator wants to apply different patch baselines to development and production instances. To achieve this, the administrator tags the development instances with the key-value pair `patch-group: RHEL-dev` and the production instances with `patch-group: RHEL-prod`. However, during the next maintenance window, Patch Manager fails to apply the custom baselines, and all instances are updated using the AWS-provided default patch baseline. Which action will resolve this issue?

  1. A
    Change the tag key on the instances to `ssm:patch-group` and register the patch groups in the Systems Manager Quick Setup console.
  2. B
    Modify the IAM role assigned to the EC2 instances to include the `iam:PassRole` permission for the Systems Manager service role.
  3. Change the tag key on the EC2 instances to the case-sensitive string `Patch Group` and register the patch groups to the respective custom patch baselines.Answer
  4. D
    Configure detailed CloudWatch monitoring on all instances to allow Systems Manager to dynamically read the default tags.

Answer

Change the tag key on the EC2 instances to the case-sensitive string 'Patch Group' and register the patch groups to the respective custom patch baselines.
The correct action is to change the tag key on the EC2 instances to the case-sensitive string 'Patch Group' and register the patch groups to the respective custom patch baselines. AWS Systems Manager Patch Manager specifically requires the exact tag key 'Patch Group' (case-sensitive and with a space) to map instances to patch groups. If the tag key is misspelled, has incorrect casing, or uses a hyphen, Patch Manager will not match the instances to their registered patch groups. Consequently, it falls back to the default patch baseline for that operating system.

Step-by-Step Solution

1
Identify why the instances are receiving the default patch baseline instead of the custom baselines.
Determine that Patch Manager is failing to associate the instances with the patch groups due to the incorrect tag key `patch-group`.
Patch Manager relies on the exact, case-sensitive tag key `Patch Group` to group instances.
2
Update the EC2 instance tags to use the correct case-sensitive key.
Change the tag key from `patch-group` to `Patch Group` on the development and production RHEL instances.
This allows Systems Manager to recognize the instances as members of the 'RHEL-dev' and 'RHEL-prod' patch groups.
3
Register the patch groups to their respective custom patch baselines.
Associate the 'RHEL-dev' patch group with the development custom patch baseline, and the 'RHEL-prod' patch group with the production custom patch baseline.
This ensures that during maintenance windows, the correct baseline rules are applied to each group.

Key Concept

AWS Systems Manager Patch Manager uses the case-sensitive tag key 'Patch Group' to associate managed instances with patch groups. Each patch group must then be registered to a patch baseline to override the default baseline.
Estimated Time:1m 0s
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic