Examkin

Soru

Zorluk: ZorPatch Management and OS Compliance Automation

A SysOps Administrator is setting up automated patching for a group of production Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The administrator designs a custom patch baseline that approves only security updates with a 'Critical' severity. The administrator tags the target EC2 instances with the key `Patch Group` and the value `RHEL-Production`. A maintenance window is configured to run the `AWS-RunPatchBaseline` document on these instances. During the next scheduled execution, the administrator notices that the instances are patched using the default AWS-provided RHEL patch baseline instead of the custom patch baseline.

Which action must the administrator take to ensure the custom patch baseline is applied to these instances?

  1. A
    Pass the custom patch baseline ARN as a parameter named `BaselineId` in the `AWS-RunPatchBaseline` task configuration.
  2. B
    Modify the tag key on the EC2 instances to `patch_group` to match the snake-case format required by Systems Manager.
  3. Associate the custom patch baseline with the `RHEL-Production` patch group within Systems Manager Patch Manager.Cevap
  4. D
    Attach an IAM policy to the EC2 instances containing the `iam:PassRole` permission for the Systems Manager default service role.

Cevap

Associate the custom patch baseline with the RHEL-Production patch group within Systems Manager Patch Manager.
Associating the custom patch baseline with the 'RHEL-Production' patch group ensures that Systems Manager Patch Manager selects the custom baseline when executing the AWS-RunPatchBaseline document on the tagged instances. If an instance has a patch group tag but that group is not associated with any baseline, the default baseline is used.

Adım Adım Çözüm

1
Verify that the managed instances are correctly tagged with the case-sensitive key 'Patch Group' and the value 'RHEL-Production'.
The target instances are verified to belong to the correct patch group.
Systems Manager Patch Manager uses this tag to associate instances with a patch group.
2
In Systems Manager Patch Manager, select the custom patch baseline and associate it with the patch group 'RHEL-Production'.
The custom baseline is mapped to the 'RHEL-Production' patch group.
Without this explicit association, Systems Manager falls back to the default patch baseline for the instance's operating system.
3
Execute the maintenance window task running the 'AWS-RunPatchBaseline' document.
The instances are successfully patched using the rule defined in the custom patch baseline.
The 'AWS-RunPatchBaseline' document resolves the baseline dynamically from the associated patch group.

Anahtar Kavram

Systems Manager Patch Manager maps managed nodes to patch baselines using patch groups. The tag key 'Patch Group' must be explicitly registered and associated with the custom baseline in Patch Manager; otherwise, the default baseline is applied.
Bu soruyu puanla

Konular

Patch Management and OS Compliance Automation

Bu konudan daha fazla soru