Examkin

Soru

Zorluk: OrtaAutomating Deployment and Configuration Management

A healthcare provider maintains a hybrid environment of Amazon EC2 instances and on-premises servers, all registered as managed instances under AWS Systems Manager. A security policy mandates that a security logging agent must be installed and continuously running on all instances. The operations team has noticed that system administrators occasionally uninstall or stop the agent during manual troubleshooting, creating configuration drift. A Solutions Architect must design a solution to automatically detect drift, reinstall the agent, and report compliance. Which solution meets these requirements with the least operational overhead?

  1. A
    Create an AWS CloudFormation stack containing a user data script to install the logging agent. Enable CloudFormation Drift Detection on a scheduled basis, and configure an AWS Lambda function to redeploy the stack whenever drift is detected.
  2. Create an AWS Systems Manager State Manager association that runs a runbook to install and start the logging agent. Target the instances using tags, and configure the association to run daily. Monitor the association status using AWS Config, and configure an Amazon EventBridge rule to forward non-compliance events to a centralized security account.Cevap
  3. C
    Deploy the logging agent package across all accounts using AWS CloudFormation StackSets. To secure the deployment, encrypt the package using an AWS managed KMS key (aws/s3) and delegate cross-account access to the key for all target accounts to pull the installer.
  4. D
    Deploy an AWS Systems Manager Distributor package containing the logging agent. Attach an AWS Organizations Service Control Policy (SCP) to the root OU that explicitly denies the execution of uninstallation commands for the logging agent on EC2 instances.

Cevap

Create an AWS Systems Manager State Manager association to install and start the logging agent, monitor it with AWS Config, and forward events to a centralized security account using Amazon EventBridge.
The correct answer uses AWS Systems Manager State Manager to enforce the configuration state of the logging agent. State Manager is designed to manage configurations on both Amazon EC2 and hybrid (on-premises) instances. The scheduled run of the State Manager association automatically reinstalls and starts the logging agent if it has been uninstalled or stopped, remediating drift. Using AWS Config to track compliance and EventBridge to forward non-compliance alerts to a central account provides a complete reporting loop with minimal operational overhead.

Adım Adım Çözüm

1
Determine the service scope needed to manage configurations on both cloud and on-premises (hybrid) servers.
AWS Systems Manager is selected since it supports hybrid managed instances through the SSM Agent, whereas CloudFormation and SCPs cannot manage or inspect on-premises server configurations.
The requirement specifies a hybrid environment of EC2 instances and on-premises servers.
2
Choose a configuration management mechanism to enforce the running state of the logging agent.
Select Systems Manager State Manager, which allows scheduling an association to run a document (like installing and starting a service) and automatically remediates configuration drift during its execution.
State Manager ensures the target state is continually enforced on a schedule.
3
Set up compliance reporting and notification routing.
Configure AWS Config to monitor State Manager association compliance and route non-compliance events via Amazon EventBridge to the central security account.
This provides centralized compliance reporting with minimal operational overhead.

Anahtar Kavram

AWS Systems Manager State Manager enables automatic drift remediation and configuration enforcement for hybrid environments, integrated with AWS Config for compliance monitoring.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management