Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

An organization has a fleet of Ubuntu Amazon EC2 instances. A SysOps Administrator creates a custom patch baseline in AWS Systems Manager Patch Manager to control which security updates are installed. The administrator registers a patch group named 'ubuntu-prod' with this custom baseline. During a scheduled maintenance window, the administrator observes that the instances are being patched, but they are receiving updates from the default AWS-provided patch baseline rather than the custom baseline.

Which of the following is the most likely cause of this behavior?

  1. The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.Answer
  2. B
    The custom patch baseline has not been set as the default patch baseline for the Ubuntu operating system in Systems Manager Patch Manager.
  3. C
    The IAM role used by the Maintenance Window to run the patch task is missing the 'iam:PassRole' permission.
  4. D
    The EC2 instances do not have the 'AmazonSSMManagedInstanceCore' policy attached to their IAM instance profile.

Answer

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.
For AWS Systems Manager Patch Manager to associate an instance with a patch group, the instance must have a tag with the exact case-sensitive key 'Patch Group' (with a space). If the tag key is 'PatchGroup' (without a space), Systems Manager fails to map the instance to the 'ubuntu-prod' patch group, causing Patch Manager to apply the default AWS-provided patch baseline instead.

Step-by-Step Solution

1
Analyze the observed behavior where instances are successfully patched but are using the default baseline instead of the custom baseline.
This indicates that the Systems Manager agent is functioning and the maintenance window is executing, but the instances are not being associated with the registered patch group 'ubuntu-prod'.
When an instance is not successfully matched to a patch group, Systems Manager Patch Manager falls back to the default baseline for that operating system.
2
Verify the requirements for defining and matching patch groups on EC2 instances.
AWS Systems Manager requires managed nodes to be tagged with the exact case-sensitive key 'Patch Group' (with a space) and the value matching the registered patch group name.
Any deviation in the tag key, such as using 'PatchGroup' or 'patch_group', will cause the baseline mapping to fail.

Key Concept

AWS Systems Manager Patch Group Tagging Requirements
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic