Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 251 discussion

Exam question from Amazon's AWS Certified DevOps Engineer - Professional DOP-C02

Question #: 251
Topic #: 1

[All AWS Certified DevOps Engineer - Professional DOP-C02 Questions]

A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux.

The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present.

Which solution will meet these requirements?

A. Create an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
B. Set up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
C. Activate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
D. Create an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.

Show Suggested Answer

Suggested Answer: A 🗳️

by xdkonorek2 at July 6, 2024, 7:29 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

spring21

8 months ago

Selected Answer: A

https://docs.aws.amazon.com/systems-manager/latest/userguide/state-manager-associations-creating.html

upvoted 1 times

...

limelight04

11 months, 3 weeks ago

Selected Answer: B

Given the requirement to detect instances and use an SSM document for installation, Option B seems most appropriate. It combines AWS Config for detection and Systems Manager for remediation.

upvoted 1 times

...

jamesf

1 year ago

Selected Answer: A

AWS Systems Manager State Manager: Automatic Detection: - State Manager allows you to manage the desired state of your AWS resources, including EC2 instances. By targeting all managed nodes, you ensure that every EC2 instance under Systems Manager's management is included in the scope. Software Installation: - You can specify a Systems Manager document (SSM document) to define the steps required to install the antivirus software. The association will ensure that the software is installed on any instances where it is missing. Continuous Compliance: - State Manager can continuously enforce the desired state, which means it will periodically check for the presence of the software and reapply the document if necessary.

upvoted 1 times

jamesf

1 year ago

Use Case Alignment: Managed Nodes Targeting: - This allows for broad application across all instances, ensuring that no instances are missed, as long as they are configured as managed instances. Ease of Configuration: - Setting up an association in State Manager is straightforward and integrates well with the existing AWS Systems Manager services, making it a robust choice for managing configurations across instances.

upvoted 1 times

...

d0229a2

1 year ago

State Manager associations A State Manager association is a configuration that you assign to your AWS resources. The configuration defines the state that you want to maintain on your resources. For example, an association can specify that antivirus software must be installed and running on a managed node, or that certain ports must be closed. An association specifies a schedule for when to apply the configuration and the targets for the association. For example, an association for antivirus software might run once a day on all managed nodes in an AWS account. If the software isn't installed on a node, then the association could instruct State Manager to install it. If the software is installed, but the service isn't running, then the association could instruct State Manager to start the service.

upvoted 1 times

...

trungtd

1 year, 1 month ago

Selected Answer: A

By creating an association, you can ensure that all instances have the antivirus software installed and kept up-to-date.

upvoted 2 times

...

tgv

1 year, 1 month ago

---> I'm between A & D Not 100% sure about this but here are my 2 cents about DETECTING the instances that don't have the software installed: A - it's a bit tricky because it states that it targets all managed nodes - but what if there are other nodes that are not managed? It just assumes that all instances are managed by AWS Systems Manager B - How can Config determine if the software is installed? C - Amazon Inspector is focused on security assessments and compliance checks, not on ensuring software is installed. It would require additional setup and is not designed for direct software installation. D - it ensures that all instances are detected. It ensures that the installed software is tracked by using the AWS Systems Manager Inventory (which is designed for this kind of things). I'm not 100% sure about the phrase "Associate the Systems Manager inventory with the Systems Manager document." which I don't believe its technically possible

upvoted 1 times

...