Q94 — AWS SAA-C03 Ch.11

Question 94 of 100 | ← Chapter 11

Q794. A company has applications that run on Amazon EC2 instances. The EC2 instances connect to Amazon RDS databases by using an IAM role that has associated policies. The company wants to use AWS Systems Manager to patch the EC2 instances without disrupting the running applications.Which solution will meet these requirements?

• A. Create a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role.Attach the new IAM role to the EC2 instances and the existing IAM role.
• B. Create an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user. Configure Systems Manager to use the IAM user to manage the EC2 instances.
• C. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances. ✓
• D. Remove the existing policies from the existing IAM role. Add the AmazonSSMManagedInstanceCore policy to the existing IAM role.

Correct Answer: C. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances.

Explanation

Apologies for the incorrect answer in the previous response. After reviewing the requirements again, the correct solution to meet the company's requirements of using AWS Systems Manager to patch the EC2 instances without disrupting the running applications is:C. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances.Enabling Default Host Configuration Management in Systems Manager allows you to manage the configuration of EC2 instances, including patching, without disrupting the running applications. Default Host Configuration Management provides a managed approach for patching EC2 instances by leveraging Systems Manager capabilities.Here's why the other options are not the best fit for the given requirements:A. Creating a new IAM role and attaching the AmazonSSMManagedInstanceCore policy: While this option allows for Systems Manager access, it doesn't specifically address the requirement of patching the EC2 instances without disrupting the running applications.B. Creating an IAM user and configuring Systems Manager to use the IAM user: This option is not recommended as using an IAM user for managing EC2 instances with Systems Manager is not the best practice. IAM users are typically used for authentication purposes, while IAM roles are more suitable for granting permissions to AWS services.D. Removing existing policies from the existing IAM role and adding the AmazonSSMManagedInstanceCore policy: Modifying or removing existing policies associated with the IAM role may interfere with the existing permissions and access control requirements, and it may not specifically address the requirement of patching the EC2 instances without disrupting the running applications.Therefore, the correct solution that meets the requirements of using Systems Manager to patch the EC2 instances without disrupting the running applications is:C. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances.