Examkin

Soru

Zorluk: KolayAutomating Deployment and Configuration Management

A startup company has deployed its web application infrastructure using AWS CloudFormation. Over time, several team members have made manual adjustments to the security groups and EC2 instance configurations directly through the AWS Console, causing inconsistencies. Additionally, the company needs to ensure that a security agent is automatically installed and kept running on all EC2 instances.

Which TWO actions should the Solutions Architect take to detect these infrastructure changes and automate the software installation? (Select TWO.)

  1. Run drift detection on the CloudFormation stacks to identify resources that have diverged from the template configurations.Cevap
  2. Create an AWS Systems Manager State Manager association to define and enforce the installation of the security agent on the instances.Cevap
  3. C
    Configure a CloudFormation stack policy to prevent direct console modifications of the resources by developers.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) that explicitly grants admin permissions to perform automatic configuration remediation.
  5. E
    Create a cross-account IAM role that uses an AWS-managed KMS key to decrypt configuration scripts during manual updates.

Cevap

Run drift detection on the CloudFormation stacks to identify resources that have diverged from the template configurations, and create an AWS Systems Manager State Manager association to define and enforce the installation of the security agent on the instances.
Running drift detection on AWS CloudFormation stacks allows developers and administrators to quickly identify resources whose properties have diverged from the template definition. Creating an AWS Systems Manager State Manager association ensures that EC2 instances stay configured with the necessary agents, preventing configuration drift on the OS level by periodically checking and enforcing the desired state.

Adım Adım Çözüm

1
Address the requirement to detect manual out-of-band modifications to CloudFormation-managed resources.
Identify that AWS CloudFormation drift detection checks the stack's resources and reports modifications compared to the template.
This identifies configuration drift without requiring third-party monitoring.
2
Address the requirement to automate and enforce software agent installation on EC2 instances.
Identify that AWS Systems Manager State Manager continuously enforces the desired configuration state (such as installing software).
This maintains operational consistency and automatically remediates compliance on the instances.

Anahtar Kavram

Detecting out-of-band resource modifications using CloudFormation drift detection and enforcing instance configurations using Systems Manager State Manager.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management