Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A SysOps Administrator is configuring AWS Systems Manager Patch Manager to automate security updates for a fleet of Amazon Linux 2023 EC2 instances. The administrator creates a custom patch baseline and associates it with a patch group named 'Production-AL2023'. The administrator then tags the target EC2 instances with the key 'PatchGroup' and value 'Production-AL2023'. During the next scheduled maintenance window, the administrator notices that the instances were patched using the default AWS-provided patch baseline instead of the custom patch baseline. What should the administrator do to ensure the instances use the custom patch baseline?

  1. Change the tag key on the EC2 instances from 'PatchGroup' to the case-sensitive 'Patch Group'.Answer
  2. B
    Add the iam:PassRole permission to the EC2 instance profile to allow Systems Manager to associate the custom patch baseline with the instances.
  3. C
    Modify the custom patch baseline configuration to target the EC2 instances directly using their Instance IDs rather than using a patch group.
  4. D
    Create a State Manager association to force the custom patch baseline to apply to the 'Production-AL2023' patch group.

Answer

Change the tag key on the EC2 instances from 'PatchGroup' to the case-sensitive 'Patch Group'.
Changing the tag key on the EC2 instances to the case-sensitive 'Patch Group' correctly registers the instances in the 'Production-AL2023' patch group. AWS Systems Manager Patch Manager relies on this exact tag key to identify which patch baseline should be applied to an instance. If the tag key is incorrect, the association fails, and Patch Manager falls back to the default patch baseline for the operating system.

Step-by-Step Solution

1
Identify the cause of the patch baseline mismatch by checking the tags on the EC2 instances and comparing them with Systems Manager requirements.
The current tag key is 'PatchGroup', which does not match the mandatory Systems Manager Patch Manager key 'Patch Group'.
Systems Manager uses the specific, case-sensitive tag key 'Patch Group' to assign instances to patch groups.
2
Update the tags on the target EC2 instances to use 'Patch Group' as the key and keep 'Production-AL2023' as the value.
The instances are now correctly mapped to the 'Production-AL2023' patch group.
This establishes the association between the instances and the patch group.
3
Verify that Patch Manager correctly associates the instances with the custom patch baseline during the next run.
The instances are patched according to the rules defined in the custom patch baseline.
With the correct patch group tag, Patch Manager overrides the default baseline and applies the custom one.

Key Concept

Systems Manager Patch Manager uses a case-sensitive tag key named 'Patch Group' to associate EC2 instances with patch groups, which are then mapped to specific patch baselines.
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic