Examkin

Soru

Zorluk: OrtaAutomating Deployment and Configuration Management

An enterprise wants to enforce a consistent configuration baseline across all Amazon EC2 instances in its AWS Organization. The baseline configuration requires that a specific third-party security daemon is installed and continuously running on all instances. During routine troubleshooting, developers occasionally stop this daemon, creating security non-compliance. A solutions architect needs to design an automated solution that detects and automatically remediates this configuration drift with the least operational overhead. Which of the following is the most efficient and compliant solution to meet these requirements?

  1. Deploy an AWS Systems Manager (SSM) State Manager association targeted at the instances. Configure the association to run a custom SSM document on a recurring schedule that checks the status of the security daemon and starts the service if it is stopped.Cevap
  2. B
    Deploy a Service Control Policy (SCP) at the root of the AWS Organization to deny permissions for stopping or disabling the security daemon service within the operating system of the EC2 instances.
  3. C
    Deploy the EC2 instances using AWS CloudFormation templates. Enable native CloudFormation drift detection to monitor the instances and configure the templates to automatically perform a stack update with a rollback configuration if the daemon stops.
  4. D
    Use AWS Config to monitor the status of the security daemon. If the daemon is stopped, trigger an AWS Systems Manager Automation runbook that uses the default AWS-managed KMS key for Systems Manager (aws/ssm) to securely decrypt configuration files and restart the service across accounts.

Cevap

Deploy an AWS Systems Manager (SSM) State Manager association targeted at the instances. Configure the association to run a custom SSM document on a recurring schedule that checks the status of the security daemon and starts the service if it is stopped.
The correct answer is the solution that uses an AWS Systems Manager (SSM) State Manager association to execute an SSM document on a schedule. SSM State Manager is specifically designed to enforce configuration baselines on EC2 instances. By targeting the instances and running a check on a schedule, State Manager can detect if the daemon has stopped and run the commands to restart it, remediating the OS-level drift automatically with minimal operational overhead.

Adım Adım Çözüm

1
Determine if the drift detection and remediation requirement applies to the AWS API level or the operating system level.
The requirement is to detect and remediate a stopped security daemon (OS-level process), which requires OS-level automation.
This rules out AWS API-level compliance mechanisms such as Service Control Policies (SCPs) and native CloudFormation drift detection.
2
Evaluate AWS Systems Manager (SSM) State Manager for managing OS-level configurations.
SSM State Manager is identified as a service that can target instances via tags and run configurations (like SSM documents) on a schedule to enforce a desired state.
State Manager automatically restarts the stopped daemon when the association runs, enforcing the configuration baseline without manual intervention.
3
Evaluate the key restrictions for cross-account or multi-account KMS access.
Cross-account access requires a Customer Managed Key (CMK) with a modified key policy; default AWS-managed keys like aws/ssm cannot be shared across accounts.
This rules out solutions that attempt to use default AWS-managed KMS keys for cross-account execution.

Anahtar Kavram

AWS Systems Manager State Manager is a configuration management service that automates the process of keeping your EC2 and hybrid infrastructure in a defined state, enabling native remediation of OS-level configuration drift.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management