Examkin

Soru

Zorluk: OrtaPatch Management and OS Compliance Automation

A financial company needs to enforce OS patch compliance across its fleet of production Windows Server 2022 EC2 instances. The system requires that only critical security updates be installed, bypassing the default AWS-managed baseline. A SysOps Administrator is tasked with establishing a weekly automated patch deployment workflow using AWS Systems Manager.

Order the steps below to reflect the correct sequence for configuring and executing this patching workflow.

  1. 1Create a custom patch baseline for Windows Server and define approval rules for critical security updates.
  2. 2Apply a tag to the target Windows Server EC2 instances with the case-sensitive key 'Patch Group' and a value like 'Win-Prod'.
  3. 3Register the 'Win-Prod' patch group with the custom patch baseline in Systems Manager.
  4. 4Create a Maintenance Window and register the target instances using the 'Win-Prod' patch group.
  5. 5Register a Run Command task under the Maintenance Window executing the AWS-RunPatchBaseline document with the Install operation.

Cevap

The correct operational sequence is: 1) Create a custom patch baseline for Windows Server, 2) Apply a tag to the target Windows Server EC2 instances with the case-sensitive key 'Patch Group' and a value like 'Win-Prod', 3) Register the 'Win-Prod' patch group with the custom patch baseline, 4) Create a Maintenance Window and register the target instances using the patch group, and 5) Register a Run Command task under the Maintenance Window executing the AWS-RunPatchBaseline document.
To successfully automate patching with a custom baseline, the administrator must first create the custom baseline containing the required rules. Next, the target instances must be tagged with the case-sensitive tag key 'Patch Group' to assign them to a patch group. The patch group must then be registered with the custom baseline to override the default baseline. Finally, a maintenance window is created, targets are registered using the patch group, and the AWS-RunPatchBaseline document task is registered to perform the installation during the window.

Adım Adım Çözüm

1
Create a custom patch baseline.
A baseline exists specifying the approval rules for critical security updates.
AWS Systems Manager Patch Manager requires a baseline to know which updates to approve. By default, it uses a generic AWS-managed baseline. A custom baseline is required to enforce specific patch rules.
2
Tag the instances with the case-sensitive 'Patch Group' key.
Instances are logically grouped together in Patch Manager.
Patch groups allow you to target specific sets of instances for baseline association and maintenance window tasks. The tag key must be exactly 'Patch Group' (case-sensitive).
3
Associate the patch group with the custom baseline.
The 'Win-Prod' patch group is registered to the custom patch baseline.
This step overrides the default baseline. Systems Manager will now apply the custom baseline rules to any instance tagged with that patch group.
4
Configure the maintenance window and targets.
A scheduled window is defined with registered EC2 targets.
The maintenance window defines when patching occurs. Registering the targets using the patch group simplifies management.
5
Register the AWS-RunPatchBaseline task to the maintenance window.
The patching task is scheduled to run on the targets during the maintenance window.
The task executes the actual patching process using the AWS-RunPatchBaseline document, which references the baseline associated with the patch group.

Anahtar Kavram

AWS Systems Manager Patch Manager operational setup sequence using custom baselines, patch groups, and maintenance windows.
Bu soruyu puanla

Konular

Patch Management and OS Compliance Automation

Bu konudan daha fazla soru